execl or execlp invoked with a variable program path may run attacker-controlled binaries.
Use absolute trusted paths and validate arguments before calling exec.