CVE-2021-40289: mm-wiki is vulnerable to Cross-Site Scripting (XSS)

The XSS vulnerability occurs in the space creation functionality where user-supplied 'tags' parameter input is not sanitized before storage. The endpoint /system/space/save is implicated in the vulnerability report, and in typical Go web application structure, this would map to a controller handler function responsible for processing form submissions. While exact code isn't available, the pattern suggests the Save handler in the space controller processes raw user input without adequate HTML escaping or validation, particularly for the 'tags' field. Confidence is medium due to reliance on endpoint mapping and vulnerability reproduction steps rather than direct code analysis.