Some values coming from untrusted sources are evaluated, so a string like ${...} in these values is replaced by the evaluated expression, for example a secured data (${sec.data.xxx}), an environment variable (${env:XXX}) or the result of other expressions.
This happens in the following cases:
Channel names saved automatically in server option autojoin when the option autojoin_dynamic is enabled (WeeChat ≥ 3.5): a channel name may come from the server, for example a channel forward with numeric 470; the channel name is evaluated when the server option autojoin is used.
Server options addresses, nicks, password and autojoin set from an IRC URL (irc://...) given on command line or with command /connect (WeeChat ≥ 0.4.2): the URL may be untrusted, for example when WeeChat is the handler of irc:// links.
Variables $nick, $channel and $server in commands /allchan, /allpv and /allserv (WeeChat ≥ 3.0): they are replaced before the command is evaluated, and nick and channel names come from the server.
A malicious IRC server, or any user able to forward a channel or to send a private message, could disclose secured data (for example passwords) or environment variables, sent back to the server in a JOIN or another command, or cause high CPU and memory usage with expressions like ${repeat:...}.
Mitigation
There are multiple ways to mitigate this issue:
Keep the server option autojoin_dynamic disabled (default) and check that the server option autojoin does not contain ${, see: /help irc.server_default.autojoin_dynamic
Do not connect to untrusted IRC URLs (irc://...) and do not use WeeChat as handler of irc:// links
Do not use variables $nick, $channel and $server in commands /allchan, /allpv and /allserv