Not sure if $taboo was getting sanitized or not. Possibly an SQL injection vulnerability that allows maliciously crafted group names to inject SQL at a later date when the group CP is loaded. Unconfirmed, theoretical fix.

// EN lang variables

tinyMCE.addToLang('',{
autosave_unload_msg : 'The changes you made will be lost if you navigate away from this page.'
});