> a single quote in the title breaks out of echo '...' and allows arbitrary command execution.

Quote injection still alive and well in 2026. Gawd.