A simple adherence to security guidelines for web applications would&#x27;ve prevented it like HTML encoding any values before reflecting them to the client.<p>So while this is very stupid, this ins&#x27;t excusable under gosh software is complicated, this is basically XSS in a desktop application.<p>If this was some RCE through the scanning or sand-boxing engine I would say fine, but this is pretty much the most common web vulnerability out there, I don&#x27;t understand companies that build HTML based interfaces and decide to simply forgo all of the existing guidelines for web development because it&#x27;s not a website.