JS: possible script injection on the todo app

going to the "todo-aerogear.rhcloud.com" app, I noticed the "tasks" are broken.

That's because there is one task in, that has the following title value:

<script>window.status='Hello World';\"></sccript>

See: https://todo-aerogear.rhcloud.com/todo-server/tasks/32

After that task, NO other tasks are being displayed Also, it looks that I can NOT add a new one, but I can... it's just not being displayed

PS: the same is true on the todoauth app (I tried it there....)