GHSA-vx5p-q85x-xm3c

### Summary A stored XSS vulnerability exists in the Formula virtual cell. Formula results containing `URI::()` patterns are rendered via `v-html` without sanitization, allowing injected HTML to execute.

### Details The `replaceUrlsWithLink()` function in `urlUtils.ts` converts `URI::(url)` patterns to `<a>` tags but passes all other HTML through unchanged. A user with Creator role (minimum role for formula field creation) can craft a formula like `CONCAT("URI::(https://example.com)", "<img src=x onerror=...>")` to inject arbitrary scripts rendered for all viewers.

### Impact Credential theft via script execution in the context of users viewing the table.

### Credit This issue was reported by [@Akokonunes](https://github.com/Akokonunes).