XSS vulnerability in link syntax when using "path:". Add clirr excludes