An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context.