[SECURITY] XSS in exception handler