The possibility for Remote Code Execution vulnerability from an unauthenticated user. This should be offloaded into a memory safe language, ideally by a parser that's been battle tested.