GHSA-hp9m-vff5-7pvw was reported by binary-lover.
Stored board, list and card titles and other activity values were interpolated into localized notification prose before it became an HTML email body. A writable member could place active markup in a title and have it delivered to another member's mail client.
Fix: the completed localized notification is escaped at the final HTML output boundary before plain-text newlines become line breaks. Notification subjects also discard newlines, preventing stored values from creating additional mail headers. Fixed for the upcoming WeKan release on 2026-08-29.