The rxvt-unicode package is vulnerable to a remote code execution, in the Perl background extension, when an attacker can control the data written to the user's terminal and certain options are set.
https://www.openwall.com/lists/oss-security/2022/12/05/1