The scheduler in HTCondor before 8.2.6 allows remote authenticated users to execute arbitrary code.
{ "urgency": "not yet assigned" }