With the Metamorph query syntax the "%" operator starts the approximate match, which uses a leading number to indicate the percent match to consider, so %2A means a two percent match to the letter A, which does match pretty much everything so it gets highlighted. There isn't any kind of security compromise.
I'll need to see if we can detect such anomalies and prevent them highlighting everything.
I'll need to see if we can detect such anomalies and prevent them highlighting everything.