really fix CGI escape this time