...and the fact that Roundup is passing arbitrary HTML in the URL for this case being submitted 
isn't great either, as it has the exact same problem. (Potentially worse, since this one allows 
arbitrary injection on a normal, non-error page)

http://issues.roundup-tracker.org/issue2550654?
@ok_message=msg%204079%20created%3Cbr%3Eissue%202550654%20created&@template=ite
m