It's bad if it's susceptible to running an attacker's arbitrary code.