An attacker may be able to perform an HTML injection (Type 2 XSS) attack by setting a cookie to a value like:
(attack code)
<script>document.alert('Hacked');</script>
The raw contents of the message file would look like: