Checkoway et al. wrote a paper "Don’t take LaTeX files from strangers" in Usenix ;login: a few years ago; People forget that LaTeX isn't just a text file -- it is basically a programming language for typesetting.

https://www.usenix.org/system/files/login/articles/73506-che...