Outline’s comment section allows users to mention others, but the server fails to validate or sanitize the href attribute of these mentions. Because dangerous protocols such as javascript: are not filtered, malicious users can embed client‑side code that executes when other users view the comment. This can lead to theft of credentials, phishing, or other malicious activity carried out in the victim’s browser. The vulnerability is a direct instance of CWE‑79: Improper Neutralization of Input During Web Page Generation.

The affected product is Outline from version 0.84.0 through 1.6.1. The fix that removes the insecure handling of href attributes was released in version 1.7.0.

The CVSS score of 7.3 indicates a medium‑to‑high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, so the overall risk cannot be precisely quantified but remains significant. The likely attack vector is client‑side, where an attacker posts a crafted comment mentioning a user with a malicious href. Any user who views the comment would then have the script executed in their browser session. Attack conditions require the attacker to have comment posting privileges and the victim to open the comment. Once exploited, the attacker can compromise the victim’s browser session but not the server itself.