In Zutty before 0.13, DECRQSS in text written to the terminal can achieve arbitrary code execution.
{ "urgency": "not yet assigned" }