XSS vulnerability: the first `badge.attribute.body.badge.name` needs to be escaped.