Earlier quoted context omitted.
A protocol analyzer implemented in anything short of formally-verified code is going to be "vulnerable" to logic errors, such that it might print (or not print) the wrong things. But a protocol analyzer implemented in C standard a decent chance of coughing up RCE.
(Playing devil's advocate): What would the RCE accomplish? "Parse this packet and get a reverse shell on analyst's workstation?" To be clear: I am not in any way attempting to disparage the project. It is damned cool, and as a neophyte Go practitioner myself, I very much appreciate its existance and utility. Just working through all the edge cases :)
I assume one reason for these console versions is that people run them directly on the server. Maybe sometimes even as root.