CodeFactor found an issue: The input method in Python 2 will read from standard input, evaluate and run the resulting string as python source code. This is similar, though in many ways worse, then using eval. On Python 2, use raw_input instead, input is safe in Python 3.
It's currently on:
steam\main.py:47
Commit 7aef2bd