fix for script execution vulnerability