Controllers.outgoing in controllers/index.js in NodeBB prior to 0.7.3 has outgoing XSS.
nodebb nodebb