I'm sure the ISS's public facing comms (I believe they host a public HAM repeater as well) are isolated. Also, there's no reason that something added well after

I'm sure the ISS's public facing comms (I believe they host a public HAM repeater as well) are isolated. Also, there's no reason that something added well after Twitter (the first ISS direct communication was a tweet - before that tweets were related through a ground station) would be done in an obsolete way. But lastly, unless they're hosting a forum, XSS is kinda irrelevant and 1995 predates XSS issues (and for most of the year JS)