Cross site scripting

Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS...