Looking at the source code it does not look like this implementation includes the virtual machine for hinting which seems the most likely source of remote code

Looking at the source code it does not look like this implementation includes the virtual machine for hinting which seems the most likely source of remote code execution vulnerabilities in a text rendering system.