Kohana v2.x - Bug Report #2766: xss_clean() doesn't handle attribute injection - Kohana Development
http://dev.kohanaphp.com/issues/2766
"Added by Rasmus Lerdorf"