It rather involved being on the other side of this airtight hatchway: If they can inject code, then they can run code
One category of the dubious security vulnerability is designing an insecure system, putting together an exploit, and then blaming one of the components of the exploit rather than the insecure system in the first place. I have found a critical security vulnerability in the XYZ scripting object which permits modifying files on the Web server itself...