HTML markup displayed as plain text in Activity Stream on WorknotesIssue HTML markup displayed as plain text in Activity Stream on Worknotes SymptomsSome of the text posted in worknotes via any Integrations can be displayed as HTML in the Activity Stream WorknotesReleaseNot release specific CauseThe issue is caused by the properties glide.ui.security.allow_codetag and ui.security.codetag.allow_script being false and being present on the instance. For glide.ui.security.allow_codetag (Security Risk: Medium - https://docs.servicenow.com/bundle/washingtondc-platform-security/page/administer/security-center/reference/sc-allow-embedded-html-code.html), if true displays rendered HTML in journal fields and forms, can open room for XSS attacks. When false, HTML is not rendered properly and HTML tags may appear in journal fields on forms. Some UI functionality may break and won't render properly. It protects against XSS Attacks. For glide.ui.security.codetag.allow_script, (Security Risk: High - https://docs.servicenow.com/bundle/washingtondc-platform-security/page/administer/security/reference/allow-javascript-tags-in-embedded-html.html), If set to true, malicious users can write harmful HTML JavaScript code that may be executed on a different client browser after rendering of journal fields.If set to false, HTML is not rendered properly and HTML tags may appear in journal fields on forms. It can have an adverse impact on functionality, and on user interactions with the resulting data. It protects against XSS(cross-site scripting). If set to true to resolve the issue, here's the risk as we see it. If you had a field on a public website where someone could type anything and that would get added to a record in ServiceNow and we were allowing embedded HTML. Then anyone could put in some HTML to include some JavaScript that would potentially cause harm when an employee views that record. Its like a legal contract where you agree to everything in the contract including whatever we put on this blank piece of paper that he will fill out later. Allow Embedded HTML means that you are telling ServiceNow to execute all our source code and some source code that comes from somewhere else no matter what instructions it might contain. This is only going to be a problem if you are going to be accepting HTML from an untrusted source. ResolutionIt’s recommended to remove the glide.ui.security.allow_codetag and ui.security.codetag.allow_script properties if they are set to false and causing issues, rather than setting them to true, which would introduce a security riskRelated Linkshttps://docs.servicenow.com/bundle/washingtondc-platform-security/page/administer/security-center/reference/sc-allow-embedded-html-code.html https://docs.servicenow.com/bundle/washingtondc-platform-security/page/administer/security/reference/allow-javascript-tags-in-embedded-html.html