My Long

The issue is related to improper input validation, allowing an authenticated user to execute arbitrary, unsandboxed javascript on the server. This can potentially lead to remote code execution.