XSS Vulnerability in Javascript: string

[pzyc0k]

Test Environment
Google Chrome - Version 75.0.3770.142 (Official Build) (64-bit)

Description
A malicious actor may insert and finally execute malicious Javascript code.

Steps to reproduce

1. Go to https://pandao.github.io/editor.md/en.html or any open editor.md apps
2. In the edit mode, input the following malicious code snippet:

[xss poc](Javascript:alert("pzyc0 poc xss with cookie: " + document.cookie))

Impact
If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user.

Expected Results
No malicious Javascript code should be executed

Remediation
In general, it is highly recommended to implement input validation, output sanitization and escaping.

Proof-of-Concept

[Xh4H]

Why are you using c if a plain Javascript:alert works?

[alromh87]

Can you try against this version please, also be sure the have the iframe filter enabled:
https://github.com/418sec/editor.md