GHSA-7c7c-373r-gfjj: Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery

**Component:** Elasticsearch indexer (`indexer/`) **Primary location:** `indexer/common.go:2395-2407` (`serializedDataForUpdateAccounts`) **Entry point:** `SetAccountName` native transaction (contract type 12) — `core/process/transaction/txProcess.go:688` --- ## Description When the node indexes account updates to Elasticsearch, it builds the ES `_bulk` painless-script line by splicing the account's **name** directly into JSON with `fmt.Sprintf("%s", ...)` and **no escaping**: ```go // indexer/common.go:2395-2407 (serializedDataForUpdateAccounts) serializedData := []byte(fmt.Sprintf(`{"script"…