Users could be tricked into running arbitrary code, but the issue was patched last week.