The could be using .js and .py files directly as config files and letting the language interpreter so the heavy lifting. Just like ye olde config.php.

And yes this absolutely will allow code injection by a config admin.