GitHub's CodeQL identified a couple of places in `mkoctfile.cc` that might lead to uncontrolled commands being executed:
https://github.com/gnu-octave/octave/security/code-scanning/31
https://github.com/gnu-octave/octave/security/code-scanning/32
https://github.com/gnu-octave/octave/security/code-scanning/33

`mkoctfile.cc` is generated from `mkoctfile.cc.in`. Afaict, the corresponding lines in that source are:
https://hg.savannah.gnu.org/hgweb/octave/file/7f4ad92265d2/src/mkoctfile.in.cc#l596
https://hg.savannah.gnu.org/hgweb/octave/file/7f4ad92265d2/src/mkoctfile.in.cc#l1151
https://hg.savannah.gnu.org/hgweb/octave/file/7f4ad92265d2/src/mkoctfile.in.cc#l1091

IIUC, the concern raised is that the commands that are being executed are potentially constructed from the values of environment variables, and there is no check whether those values are "sane".
That's indeed the case: We allow, e.g., to override the default C++ compiler by setting the environment variable `CXX`. And IIUC, we want to allow that.

Afaict, to "exploit" this a user would need to be able to set environment variables and run commands on the system where `mkoctfile` is running. And, IIUC, the spawned processes will run with the same rights as `mkoctfile`. So, the impact is pretty limited, and anything going wrong might be a "user error" imho.
But, I'd like to hear from others if they think differently.