Unvalidated input can always be an exploit vector.
Except in C, validation of user input can in itself be an exploit vector.
alt Hacker News
Except in C, validation of user input can in itself be an exploit vector.