The content of action_name is not encoded before displaying an error
message.

Example:
/support/issue1?@action="><script>alert(1)</script>

The issue is in the following line from cgi/client.py:
raise ValueError('No such action "%s"'%action_name)