In Mercurial before 4.1.3, hg serve --stdio allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name. https://nvd.nist.gov/vuln/detail/CVE-2017-9462
