When using auxiliary variables with secagg, the researcher needs to unflatten module-wise cleartext values.
For that purpose it instantiates an object from an AuxVar subtype, the class of the subtype being sent by the nodes

        return aux_cls.from_dict(fields)

Problem: researcher does not check the received class received through the network is a valid and existing class (a subclass of AuxVar that really exists on the researcher.

This may give way to a malicious attacker to execute arbitrary code by sending another class name.
If confirmed, we may need to add check for class names in clear_cls