In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation
CWE-77, CWE-77