Cross site scripting

Pandao Editor.md 1.5.0 allows XSS via crafted attributes of an invalid IMG element...