AIKIDO-2026-801631

TL;DR

The Link extension's isAllowedUri validator builds its scheme-checking regex from a JavaScript template literal where \- collapses to -, so unknown hyphenated URI schemes such as unknown-protocol://test can be accepted as allowed links. An attacker who can supply editor link content may persist disallowed protocol links that bypass the built-in allowlist used during parsing, rendering, autolinking, paste handling, and link commands. Before the fix, those links could survive validation and be stored in editor output. The patch double-escapes the hyphen terminator and escapes protocol names when constructing the regex so unknown hyphenated schemes are rejected again.