> I see no reason to assume that configuration would be the only (or dominant) source of unchecked interpolation inputs. Given as it was the maintainers who lo

> I see no reason to assume that configuration would be the only (or dominant) source of unchecked interpolation inputs. Given as it was the maintainers who lodged the CVE, and their description that I was quoting, I'm reasonably happy it's a correct statement. I'll be honest, I haven't dived into the code to verify that myself. But if you have, please feel free to share your findings :)