[cratermoon]

Even non-trivially validating it can go wrong. See Log4Shell, e.g.

The bigger problem here is executing user input.