mailman: arbitrary content injection via the options login page

/options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection...