OX App Suite through 7.10.5 allows XSS via a trailing control character such as the SCRIPT\t substring.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-44212.json"