[SECURITY] Missing escaping in scheduler