diff --git a/src/main/java/org/apache/commons/cli/Converter.java b/src/main/java/org/apache/commons/cli/Converter.java
index d655205ea..a5e9c9b8f 100644
--- a/src/main/java/org/apache/commons/cli/Converter.java
+++ b/src/main/java/org/apache/commons/cli/Converter.java
@@ -46,6 +46,10 @@ public interface Converter<T, E extends Exception> {
     /**
      * Converts a String to a {@link Class}. Calls {@link Class#forName(String, boolean, ClassLoader)} with {@code initialize} set to {@code false} so that
      * resolving the name does not by itself trigger the class's static initializer.
+     * <p>
+     * The value can name any class visible to the class loader of this library. Do not apply this converter, the default for options of type {@link Class},
+     * to values from an untrusted source.
+     * </p>
      */
     Converter<Class<?>, ClassNotFoundException> CLASS = s -> Class.forName(s, false, Converter.class.getClassLoader());
 
@@ -66,6 +70,10 @@ public interface Converter<T, E extends Exception> {
 
     /**
      * Converts a class name to an instance of the class. Uses the Class converter to find the class and then call the default constructor.
+     * <p>
+     * Creating the instance initializes the named class and runs its public no-argument constructor, so the value decides which code runs. Do not apply this
+     * converter, the default for options of type {@link Object}, to values from an untrusted source.
+     * </p>
      *
      * @see #CLASS
      */
diff --git a/src/main/java/org/apache/commons/cli/PatternOptionBuilder.java b/src/main/java/org/apache/commons/cli/PatternOptionBuilder.java
index f68cfaeac..1cecc68b3 100644
--- a/src/main/java/org/apache/commons/cli/PatternOptionBuilder.java
+++ b/src/main/java/org/apache/commons/cli/PatternOptionBuilder.java
@@ -35,7 +35,7 @@ Licensed to the Apache Software Foundation (ASF) under one or more
  * </tr>
  * <tr>
  * <td>b@</td>
- * <td>-b [class name]</td>
+ * <td>-b [class name] (creates object via public no-argument constructor)</td>
  * </tr>
  * <tr>
  * <td>c&gt;</td>
@@ -43,7 +43,7 @@ Licensed to the Apache Software Foundation (ASF) under one or more
  * </tr>
  * <tr>
  * <td>d+</td>
- * <td>-d [class name] (creates object via empty constructor)</td>
+ * <td>-d [class name]</td>
  * </tr>
  * <tr>
  * <td>e%</td>
@@ -69,6 +69,12 @@ Licensed to the Apache Software Foundation (ASF) under one or more
  * </pre>
  *
  * <p>
+ * When a converted option value is retrieved, for example through {@link CommandLine#getParsedOptionValue(String)}, the {@code @} and {@code +} codes
+ * load the class named by the option value, and {@code @} also creates an instance by calling its public no-argument constructor. Do not use these codes
+ * for values from an untrusted source.
+ * </p>
+ *
+ * <p>
  * TODO These need to break out to OptionType and also to be pluggable.
  * </p>
  */
diff --git a/src/main/java/org/apache/commons/cli/TypeHandler.java b/src/main/java/org/apache/commons/cli/TypeHandler.java
index 4709c7811..8fe815b26 100644
--- a/src/main/java/org/apache/commons/cli/TypeHandler.java
+++ b/src/main/java/org/apache/commons/cli/TypeHandler.java
@@ -49,6 +49,9 @@ public class TypeHandler {
 
     /**
      * Returns the class whose name is {@code className}.
+     * <p>
+     * Do not pass a class name from an untrusted source, see {@link Converter#CLASS}.
+     * </p>
      *
      * @param className The class name.
      * @return The class if it is found.
@@ -124,6 +127,10 @@ public static Number createNumber(final String string) throws ParseException {
 
     /**
      * Creates an Object from the class name and empty constructor.
+     * <p>
+     * This initializes the named class and runs its public no-argument constructor. Do not pass a class name from an untrusted source, see
+     * {@link Converter#OBJECT}.
+     * </p>
      *
      * @param className The argument value.
      * @return The initialized object.