Original report at : 
http://psf.upfronthosting.co.za/roundup/meta/issue519 about the python 
modifier roundup bugtracker.

This post : http://mail.python.org/pipermail/python-committers/2013-
July/002606.html seems to highlight that this is a roundup security 
issue while this confirms it : http://issues.roundup-tracker.org/user?
@sort=%3Cscript%3Ealert('XSS')%3C/script%3E%3Ch1%3E

XSS issues allow for many things including stealing session cookies. It 
might be worth to read the entire report on the python meta-tracker 
since it shows another issue closely related (also with the sort 
parameter).

Thibault Févry