XSS vulnerability in link syntax when using "path:". Use a secure renderer if there is one available