text: Title: QST: Does the project consider DataFrame.query() arbitrary code execution to be a security vulnerability?
  Body: ### Research
  
  - [X] I have searched the [[pandas] tag](https://stackoverflow.com/questions/tagged/pandas) on StackOverflow for similar questions.
  
  - [X] I have asked my usage related question on [StackOverflow](https://stackoverflow.com).
  
  
  ### Link to question on StackOverflow
  
  https://stackoverflow.com/questions/79304226/should-i-manually-patch-the-pandas-dataframe-query-vulnerability-or-wait-for-a
  
  (To clarify, this question was written by another user.)
  
  ### Question about pandas
  
  Hi, I saw [this question on StackOverflow](https://stackoverflow.com/questions/79304226/should-i-manually-patch-the-pandas-dataframe-query-vulnerability-or-wait-for-a), which is about a public CVE, [CVE-2024-9880](https://huntr.com/bounties/a49baae1-4652-4d6c-a179-313c21c41a8d).
  
  The basic premise of the CVE is that if an attacker controls the `expr` argument to DataFrame.query(), then arbitrary code execution can be achieved.
  
  The example given in the CVE is 
  
  <details>
  
  ```python
  import pandas as pd
  
  
  df = pd.DataFrame({'a': [1, 2, 3], 'b': ['error_details', 'confidential_info', 'normal']})
  
  
  query = '@pd.core.frame.com.builtins.__import__("os").system("""ping google.com #""")'
  try:
      engine = "python"
      result = df.query(query,local_dict={},engine="python",).index
  except Exception as e:
      print(f'Error: {e}')
  ```
  
  </details>
  
  However, this is not minimal, and a more minimal construction would be 
  
  ```python
  import pandas as pd
  
  df = pd.DataFrame()
  
  expr = '@pd.compat.os.system("""echo foo""")'
  result = df.query(expr, engine='python')
  ```
  
  (The report also says that `engine='python'` is required, but both `engine='python'` and `engine='numexpr'` worked in my testing.)
  
  My question is about Pandas's security model. What security guarantees does Pandas make about DataFrame.query() with an attacker-controlled `expr`?
  
  My intuition about this is "none, don't do that," but I'm wondering what the Pandas project thinks.