CVE-2026-105456

The RTIR extension for Request Tracker (RT) introduces a Stored XSS vulnerability due to a flawed HTML scrubber rule. The extension allows internal link placeholders but incorrectly permits any link containing that placeholder, including those using the javascript: scheme. This change affects the...