[jlv2]

More like "the danger of thinking you can trivially validate user-supplied input" before evaluating the string.

[cratermoon]

Even non-trivially validating it can go wrong. See Log4Shell, e.g.

The bigger problem here is executing user input.