As user1 set your displayname to <a href="https://nextcloud.com">Name</a>
As user2 autocomplete the name in the comments input (or Talk chat input)
Click on the user name you just autocompleted
User2 is redirected to https://nextcloud.com
Only works with HTML, not with script
User1 can trick user2 to render any html
Thanks a lot for reporting this potential issue back to us!
Our security team will take a look at this issue as soon as possible. We will reply to your report within 72 hours, usually much faster. For obvious reasons we'd like to ask you to not disclose this issue to any other party.