A remote code execution risk was identified in the Lesson activity. By default this was only available to teachers and managers.