Remote code execution from account via SearchSuggestSourceSheet

Steps to reproduce:

1. As a user without script or programming right, edit any page like your user profile with the object editor.
2. Add an object of type XWiki.SearchSuggestSourceClass
3. Set some properties of the object to the value 

    }}}{{async}}{{groovy}}println("Hello from Groovy!"){{/groovy}}{{/async}}

   

4. Save and view the page.
5. Add ?sheet=XWiki.SearchSuggestSourceSheet to the URL.

Expected result:

The entered values are displayed as-is.

Actual result:

The value

Hello from Groovy!}}} 

is displayed for all fields where a value has been set. This demonstrates a privilege escalation from a simple user account to programming right.

The vulnerable code has been introduced in XWIKI-9392 which leads to an affects version of XWiki 5.2.