The issue is related to improper implementation of security checks for script injection, allowing remote attackers to execute scripts via `javascript:` URLs. This can be achieved through various methods, including using a `javascript:` URL in a `view-source:` URL, a `javascript:` URL in a `jar:` URL, or a nested variant.