CVE-2025-13523: Mattermost Confluence plugin doesn't properly escape user-controlled display names in HTML template rendering

February 6, 2026

Mattermost Confluence plugin version < 1.7.0 fails to properly escape user-controlled display names in HTML template rendering which allows authenticated Confluence users with malicious display names to execute arbitrary JavaScript in victim browsers via sending a specially crafted OAuth2 connection link that, when visited, renders the attacker’s display name without proper sanitization. Mattermost Advisory ID: MMSA-2025-00557

References

github.com/advisories/GHSA-ffx7-34p2-vm3w
github.com/mattermost/mattermost-plugin-confluence
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2025-13523

Code Behaviors & Features

Detect and mitigate CVE-2025-13523 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →