CVE-2023-35075 (published 2023-11-27T09:09:19.659Z)
Mattermost fails to use  innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by create a channel name that is valid HTML. No XSS is possible though. 


Affected products: Vendor: Mattermost
Product: Mattermost
Versions: 0, 0, 7.8.13, 8.1.4