Poznote 6.68.7
🔒 Security: fixes two stored XSS vulnerabilities reported by @skeletonsec (GHSA-4j6w-6478-cg7j and GHSA-vv49-2463-g2gj). HTML-escaped iframe, video and audio tags stored in a note are now rebuilt from an attribute allow-list with a strict domain check before being displayed, and task edits made through a public share link are sanitized like every other public edit. Thanks to @skeletonsec for the responsible disclosure.
Contributors
skeletonsec