A T M O S; Thread: xss and RCE vulnerabilities found; 03.11.2019
Pretty much all input are currently vulnerable, you should really audit a bit more before pushing...