Community API allows CSS Injection through content description fieldIssue When content is created through the Community API, the description field accepts and renders <style> elements. As a result, user-supplied CSS is executed in the browser when the content is viewed. This allows a user to modify the appearance of the entire page, including elements outside the user-generated content container. Examples observed include: Changing the page background color.Hiding page content.Displaying a full-page overlay that obscures legitimate content. This behaviour indicates that style elements are not being properly sanitized before rendering. Release Australia Patch 6 Resolution The defect will be resolved in the Brazil release, but the below workaround can be used as well:- Open the following record - /sys_script_include.do?sys_id=21d0a00ecbc53200b2d05ea3434c9c1a - Replace below return statement in line no 375: return SNC.GlideHTMLSanitizer.sanitizeWithConfig('CommunityHTMLSanitizerConfig', text); with this: var sanitized = SNC.GlideHTMLSanitizer.sanitizeWithConfig('CommunityHTMLSanitizerConfig', text); return sanitized ? sanitized.replace(//gi, '') : sanitized; It's recommended testing these changes in a lower environment before deploying them to production. As these are considered customisations, please revert them before proceeding with an upgrade.