code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute

Impact A Stored Cross-Site Scripting XSS vulnerability exists in the rich text editor due to improper sanitization of the srcdoc attribute on elements. While the underlying Symfony HtmlSanitizer correctly HTML-encodes special characters inside the attribute value e.g., converting to script, the...