SQL Injection in the Query Analytics Explain page

Hello,
the new feature of explaining with replacing placeholders is not filtering the input parameters and it's allowing writing any sql code there. It's going to be passed later to explain, not sure if going out of that is possible or not.

Steps to reproduce:
01) Open explain page of any query that requires placeholder to be filled out. For instance: this one.
02) Write any sql query in the placeholders.
03) Execute the query.