In affected versions of Octopus Deploy it is possible to render user supplied input into the webpage
octopus octopus server