Uber: XSS in ubermovement.com via editable Google Sheets

A publicly-editable Google Sheet rendered on various ubermovement.com subdomains allowed anyone to inject HTML content into the page. It was possible for an attacker to inject malicious JavaScript code into the page by editing cells within the sheet, which would then be loaded by anyone who viewe...