Does this really work? Won't be this a security issue since this may be used for privilege escalation?

Based Wikipedia