CVE-2017-18879: Mattermost Server is vulnerable to XSS through author_link field in Slack attachments in github.com/mattermost/mattermost-server

02 / AFFECTED SOFTWARE

Affected packages

Unknown Unknown

14 explicit affected versions

Go github.com/mattermost/mattermost-server

03 / CONNECTIONS

related SUSE-SU-2025:4395-1

related OPENSUSE-SU-2026:21483-1

04 / EVIDENCE

Open Source Vulnerabilities GO-2025-4189

Mattermost Server is vulnerable to XSS through author_link field in Slack attachments in github.com/mattermost/mattermost-server

Open Source Vulnerabilities GHSA-498j-wxww-j897

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the author_link field of a Slack attachment.

Open Source Vulnerabilities CVE-2017-18879

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the author_link field of a Slack attachment.

05 / REFERENCES