In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23.
https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29
http://www.openwall.com/lists/oss-security/2024/04/08/6
http://www.openwall.com/lists/oss-security/2024/04/08/6