Is there a specific sort of attack you're worried about or that you've been found vulnerable to?

If your app requires the use of those tags, then you must do so judiciously, keeping the potential for security issues in mind

Sandbox security is often times used in shared hosting where the person who owns the server doesn't necessarily trust the people deploying the code! So a shared CF host would likely lock down a tag like that completely.

If you control this server, just ensure any use of cfexecute doesn't allow a malicious user to control its input to run arbitrary commands.

So

<cfexecute name="ping" arguments="google.com">

would be pretty hard to hack

But

<cfexecute name="ping" arguments="#url.hostname#">

would be very easy to hack by providing something like

localhost && sudo bad thing here

in the URL

I actually don't know for sure if that would work ☝️ but hopefully you get the picture