https://github.com/stefanbuck/github-issue-parser/releases/tag/v3.0.0

The reasoning for script injection makes sense, but I'm curious as to why not bake ${{ github.event.issue.body }} in as a default in the action?

Like:

  issue-body:
    required: true
    description: 'Issue body to parse'
+   default: ${{ github.event.issue.body }}