malicious codes in text boxes

Summary:

Our client has a third party vendor to assess / test the security and safety of the application. In oracle recruiting cloud, we have custom (dff) text fields built. see red box in screenshot below.

In the custom textbox field, a user can enter any malicious javascript code even though that was not the expected data for the field.
Is there a way for the system to detect that?

Content (please ensure you mask any confidential information):

Version (include the version you are using, if applicable):

Code Snippet (add any code snippets that support your topic, if applicable):