The Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend renders them using LitElement's "unsafeHTML()" directive, resulting in stored cross-site scripting (XSS). Any authenticated user with access to a site that has the Conversations tool enabled can inject arbitrary HTML and JavaScript that executes in the browsers of all other users who view that topic or post.