A very large number of academic publishing sites execute arbitrary (La)TeX as part of their online submission process. The general consensus is that it's safe i

A very large number of academic publishing sites execute arbitrary (La)TeX as part of their online submission process. The general consensus is that it's safe if you disable a number of primitive commands that give broader OS API access, such as "write18" [1], a TeX primitive that gives you shell access. The good thing about pdf(La)TeX is that it's so old that it's pretty damn battle-hardened and I'm unaware of any recent exploits that use it. If you blow up the stack, it notes that you've done so, and dies. I think it has canaries built in, too, but I might be wrong. [1] https://tex.stackexchange.com/questions/20444/what-are-immediate-write18-and-how-does-one-use-them https://tex.stackexchange.com/questions/20444/what-are-immed...