[SECURITY][High] XSS risk via unsafe HTML rendering in notice/metadata views

[lhy8888]

Summary

UI rendered potentially untrusted content via v-html and HTML cell mode in user-facing tables.

Severity

High

Affected Files

cmdb-ui/src/views/noticeCenter/index.vue, cmdb-ui/src/modules/cmdb/views/ci/modules/MetadataDrawer.vue

Recommended Remediation

Switch rendering to safe text output and remove HTML-only rendering mode in these views.

Patch Branch

codex/sec-ui-xss-notice-metadata

Patch Commit

3b68276

Fork Branch URL

https://github.com/lhy8888/cmdb-security-fork/tree/codex/sec-ui-xss-notice-metadata