Researchers found vulnerabilities, now fixed, that could have turned your crockpot into a launching pad for malicious JavaScript.