Hacker News Reader

It allows full RCE from an uploaded or opened file. That seems reasonably critical to me.

Thats.. in bad faith.

If thats the qualification for "remote" then you can say that every attack is remote and it clearly isnt.

Does this work with .pdf files? i.e. attacker uploads evil.pdf

yes, also with .eps files