I added description to a task which looked like this: <script>alert('lol!');</script>

And it happily runs the script when you view that task.