From what I understand, this allows arbitrary command execution. So, an attacker can specify a string of text that something on the affected system will just plop into a command line and execute.

Not trying to be contrarian or a smart-ass, but aren’t water cooled systems kinda just air cooled systems with the radiator moved elsewhere?