CRITICAL BUG: Fix XSS via links