An attacker who controls the configuration probably can just tell irssi to download his malware and run it.

It might be a good idea to check the parser for bugs but these aren't real security issues.