Comment by wswin

They don't have access to the host filesystem nor environment variables and this attack wouldn't work.