In ZNC before 1.9.1, remote code execution can occur in modtcl via a KICK.
{ "urgency": "not yet assigned" }