In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23.
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-37105.json"