xss filter don't filter for <img src="host"/>

hello
we found potentiol issue withh xss filter function,
data like:
<img src="host" />
is not filtered
if 'host' is malicious = > potiental remote attack
regards