Patch XSS vulnerability