GuidedTour can add on-wiki tours (which are JavaScript files in the MW namespace) to pages where user JS is not supposed to be allowed.
I have a fix locally, which I'll upload shortly as a patch (I can do a Gerrit draft if that's secure too).
Version: unspecified
Severity: normal