User blog comment:KockaAdmiralac/Security issues/@comment-28083312-20180829022059/@comment-26402117-20180830133847

There was actually a similar issue in Chat itself from HTML concatenation. They switched links to the DOM API and that resolved it for them.