SECURITY: XSS in unclosed internal links