The bundled version of atlassian-renderer in Atlassian JIRA before version 7.7.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in nested wiki markup. For more information see https://jira.atlassian.com/browse/RNDR-153 (currently restricted to Atlassian staff).