I haven't looked, but I suggest security-officer@ looks into it to see if this may be exploited passively?