arbitrary code execution vulnerability