A malicious project name containing Javascript will not be sanitised before being printed in the relationships table (the bug view page).

Relevant code from relationship_api.php:

# add project name
if( $p_show_project ) {
    $t_relationship_info_html .= $t_td . $t_related_project_name . '&nbsp;</td>';
}