collective/collective.portlet.twitter — pull request #2 by davidjb (2013-10-09 05:40:07+00:00)
Title: Fix potential XSS issue with arbitrary JS or HTML

By creating a value for one of the portlet's attributes, such as the data ID, to close out the quoted data attribute, one can inject arbitrary content (JS, HTML, CSS) onto a page. A value might be:

'>