The issue is related to a stored XSS vulnerability that allows a DAG author to add unbounded and not-sanitized JavaScript in the parameter description field of the DAG. This JavaScript can be executed on the client side of any user who looks at the tasks in the browser sandbox, allowing modification of what the user sees in the browser. This opens up possibilities of misleading other users.