Major web template flaw lets miscreants break out of sandboxes

This type of injection is way worse than XSS

Black Hat 2015 A serious fresh category of web security vulnerability creates the potential for all sorts of mischief, security researchers warn."