QMarkdown Cross-Site Scripting (XSS) vulnerability

QMarkdown aka quasar-ui-qmarkdown before 2.0.5 allows XSS via headers even when when no-html is set...