Eh, that sounds like it's not a vulnerability at all. Most app server configuration files allow you to load and run arbitrary code.
I do not understand this. Configuration files allow you to load and run arbitrary code? Is this actually a thing? What are they using for configuration files?! Tcl?
I don’t know how common it is to specify paths to/file name for DLL’s in config to load at runtime for C#, but probably not totally unheard of? And if you can edit the config, maybe you can place a DLL somewhere as well…?
(But at the some time if you can edit the config, maybe you can just replace/patch the main binary in the first place…)
But if your attacker has gotten so far as to be able to tamper with these config files then it's probably game-over already.
Webpack is (arguably) one of the most common tools in the nodejs/browser ecosystem, and it has a regular JS file as it's config file (usually named `webpack.config.js`).
One example is package.json. It's a JSON file, yeah, and normally doesn't contain any code. But one of the fields is `scripts` which can contain a object with a key like `preinstall` (and more) that runs those as shell commands at different lifecycle of using `npm`.
So just because you're using those languages/syntaxes, doesn't mean there isn't any way of executing code via them.
This would be preferable, since Tcl allows you to configure safe interpreters that can deny use of any specified set of commands, including those that give access to files and network services.