Comment by xyzzy_plugh

I'm not sure I understand how this is malicious. There is quite a bit of configuration of the client, which usually requires arbitrary execution capabilities anyways. What's the actual exploit here?