Original report at : 
http://psf.upfronthosting.co.za/roundup/meta/issue519 about the python 
modifier roundup bugtracker.

This post : http://mail.python.org/pipermail/python-committers/2013-
July/002606.html seems to highlight that this is a roundup security 
issue while this confirms it : http://issues.roundup-tracker.org/user?
@sort=%3Cscript%3Ealert('XSS')%3C/script%3E%3Ch1%3E

XSS issues allow for many things including stealing session cookies. It 
might be worth to read the entire report on the python meta-tracker 
since it shows another issue closely related (also with the sort 
parameter).

Thibault Févry

Thanks for the note. I guess we need to take a look.

Fixed in commit 24b8011cd2dc.

Note that the bug with sort/group parameters is not in roundup core
currently, that took me a while to find what you mean (roundup currently
doesn't issue an error message when you specify non-existing properties
in sort/group).
But having a 'structure' tag -- which indicates that the template will
not escape the text -- is asking for trouble. So I've reworked that part
and *all* messages (error and ok) are now escaped.

This *needs* a change to the template. So if you apply only the patch to
roundup core you're *more vulnerable than before*. Be sure to apply the
patch to the template, see doc/upgrading.txt.

I've already committed the necessary changes to roundups roundup tracker.