Alchemy::Node validated its url with a pattern that accepted any URI scheme, and the linkable ingredients (Link, Text, Picture) never validated their url at all. A user with permission to edit menus or element content could therefore store a javascript: url, which the menu template and the ingredient view components render as the href of an <a> element. Activating such a link executes the stored script in the site's origin, with the privileges of whoever clicked it.