What is GHSA-ffx7-34p2-vm3w?

GHSA-ffx7-34p2-vm3w is a security advisory published by GitHub Security Advisories with High severity. Mattermost Confluence plugin doesn't properly escape user-controlled display names in HTML template rendering

Which CVE IDs does GHSA-ffx7-34p2-vm3w cover?

GHSA-ffx7-34p2-vm3w covers the following CVE IDs: CVE-2025-13523. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-ffx7-34p2-vm3w?

GHSA-ffx7-34p2-vm3w has a CVSS v3 base score of 7.7, published by GitHub Security Advisories.

Which products are affected by GHSA-ffx7-34p2-vm3w?

GHSA-ffx7-34p2-vm3w affects 1 product, including: go/github.com/mattermost/mattermost-plugin-confluence:\u003c 1.7.0.

GHSA-ffx7-34p2-vm3wHighCVSS 7.7

Mattermost Confluence plugin doesn't properly escape user-controlled display names in HTML template rendering

Vendor

GitHub Security Advisories

Published

February 6, 2026

Last Modified

February 6, 2026

🔗 CVE IDs covered (1)

CVE-2025-13523 →

📋 Description

Mattermost Confluence plugin version < 1.7.0 fails to properly escape user-controlled display names in HTML template rendering which allows authenticated Confluence users with malicious display names to execute arbitrary JavaScript in victim browsers via sending a specially crafted OAuth2 connection link that, when visited, renders the attacker's display name without proper sanitization. Mattermost Advisory ID: MMSA-2025-00557

🎯 Affected products1

go/github.com/mattermost/mattermost-plugin-confluence:< 1.7.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2025-13523
https://mattermost.com/security-updates
https://github.com/advisories/GHSA-ffx7-34p2-vm3w