The security flaw is due to an injection weakness described by the company in an advisory issued today as “Improper Neutralization of Special Elements in Output Used by a Downstream Component.”