Worldweaver DX Studio Player 3.0.29.0 3.0.22.0 3.0.12.0 and probably other versions before 3.0.29.1 when used as a plug-in for Firefox does not restrict access to the shell.execute JavaScript API method which allows remote attackers to execute arbitrary commands via a .dxstudio file that invokes this method.