XSS vulnerability found in the lepture/editor markdown preview page

[jackfromeast]

Hi, lepture/editor developer!

Currently, the markdown rendering page does not sanitize user input for scripts, which can lead to Cross-site Scripting (XSS) in the markdown preview page.

Payload

<img src=1 onerror="javascript:alert(document.domain)">

Impact

Users of lepture/editor who open untrusted markdown files on the platform (i.e., http://lab.lepture.com/editor/) are vulnerable to XSS attacks.

Note that, since the project doesn't set the security policy, I directly report the vulnerability here.