The purpose of JMeter is to execute the workload specified
in the input jmx file, which may include arbitrary code.
As such, the JMeter security model assumes you trust
jmx input files: even opening a jmx input file may in some
cases trigger code execution. If you want to use JMeter to
evaluate untrusted jmx files, it is up to you to provide the
required isolation.
Still in the area of security, when JMeter is used in distributed
environment, we recommend setting up the security manager in order
to avoid any execution of malicious code on the distributed
architecture. See the
Security-Manager documentation for its implementation.