Vaadin 7.7.6 Cross Site Scripting

first time poster, so I'm not sure if this is the best venue, format, etc. https://github.com/vaadin/framework/issues/8731 using vaadin 7.7.6 using example https://vaadin.com/docs/-/part/framework/components/components-combobox.html but with malicious text that assumes humans are adding the plane...