I’ve reviewed the add-on and confirmed that it is executing remote code.
Bug 1551937 Comment 1 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
I’ve reviewed the add-ons and confirmed they are executing remote code.