Potential DOM XSS in `osctrl-admin`

[javuto]

A malicious XSS payload can be injected in the environment name, inside the function statsRefresh:

https://github.com/jmpsec/osctrl/blob/master/admin/static/js/stats.js

Although exploitation would be hard, is better to follow best practices and consider this as a dangerous vulnerability.