> rendering unsafe HTML tags such as <img> or <form> that point to external domains not under gitlab.com

Does that mean the minute there is a vulnerability on another gitlab.com url (like an open redirect) this vulnerability is back on the table?