Execution of malicious exif data

If someone put malicious data in the exif data of a picture this is executed when you view the photo.

In the sidebar where the exif data is shown, this isn't filtered in the output.