I suppose it could not derive to arbitrary code execution, isn't it?