XSS vulnerability in GitLab prior to 6.5.0

Looks like this is the fix: https://github.com/gitlabhq/gitlabhq/commit/d6c037de81096680...

CVE and exploit at http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-731...

That's quite surprising, it's a textbook XSS vulnerability. It seems to me that their markdown library should escape entities by default or they will have many other vulns.