XSS vulnerability in link syntax when using "path:". Add testing