XSS in TweetDeck

It works in the Chrome client and the Windows client apparently; viewing any tweet with script tags in either client results in that script running.

Confirmed that this works in Linux Chrome. How is it possible that this has not been picked up before? Or is it a new vulnerability?