Mattermost Confluence plugin doesn't properly escape user-controlled display names in HTML template rendering in github.com/mattermost/mattermost-plugin-confluence
{
"url": "https://pkg.go.dev/vuln/GO-2026-4456",
"review_status": "UNREVIEWED"
}