# Is this XSS attack?

**URL:** https://meta.discourse.org/t/is-this-xss-attack/396985
**Category:** Support
**Created:** [February 25, 2026, 9:23am UTC](https://meta.discourse.org/t/is-this-xss-attack/396985 "2026-02-25T09:23:42Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![xwj](https://avatars.discourse-cdn.com/v4/letter/x/f6c823/32.png) [@xwj](https://meta.discourse.org/u/xwj)
#### Post date: [February 25, 2026, 9:23am UTC](https://meta.discourse.org/t/is-this-xss-attack/396985/1 "2026-02-25T09:23:43Z")

</div>

My dicourse version is 3.5.0,and the content security policy is on.

I send a post like:

```plaintext
111<a href=”https://www.baidu.com/”>aa</a>

```

It finally show this after I commit.

![6625b26b-5d51-4cff-8826-5326d0e98977](https://global.discourse-cdn.com/meta/original/4X/d/9/e/d9e75143e4ee003da66ab48eae604c2f1a32578a.png)

When I click text ”aa”, it redirects to the website.  
And I want to edit the post, the link disappear.

![1c04269c-e43d-4952-9cac-86a4ea7bd419](https://global.discourse-cdn.com/meta/original/4X/8/9/2/892a711695b145413a06c8fb7d9fec7808774b54.png)

---

<div class="post-metadata">

### Author: ![singi2016cn](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/singi2016cn/32/532755_2.png) [@singi2016cn](https://meta.discourse.org/u/singi2016cn)
#### Post date: [February 25, 2026, 9:52am UTC](https://meta.discourse.org/t/is-this-xss-attack/396985/2 "2026-02-25T09:52:52Z")

</div>

> Then when I tried to edit the post, the link disappeared.

What does this sentence mean?

From your description, it doesn’t look like an XSS attack.

---

<div class="post-metadata">

### Author: ![Moin](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/moin/32/554653_2.png) [@Moin](https://meta.discourse.org/u/Moin)
#### Post date: [February 25, 2026, 9:55am UTC](https://meta.discourse.org/t/is-this-xss-attack/396985/3 "2026-02-25T09:55:31Z")

</div>

Which composer mode do you use for editing? The rich text editor or markdown mode? There have been lots of improvements for the rich text editor in the past months. Does the same happen on [try.discourse.org](http://try.discourse.org)? If not, an update might fix this.