Mapbox: XSS (cross-site scripting) on www.mapbox.com/maki

Hi there, There is an XSS that allows to inject code throw the variable window.name. I had found it two weeks ago but like I told you in the email I was unable to submit you the report. PoC: window.open"https://www.mapbox.com/maki/", "alertdocument.cookie"; This is due to the print of the value...