Authenticated Gaia users, at least read-only privilege, can inject code or commands by global variables through HTTP requests.