The Not allowed to load local resource exception is thrown on an attempt to insert a script to a form's title

[JaneSjs]

T17063 - xss script in title
https://surveyjs.answerdesk.io/internal/ticket/details/T17063

[srop]

@novikov82 >"><img src="x:x" onerror="alert(document.cookie)"> cloud you try to ctrl+v this script . Alert cookie is still found

[novikov82]

@srop
The issue is done and closed but has not been released yet. Please wait for the v1.9.133 release. It is expected to be available in the middle of this week.

[JaneSjs]

+1 T17086 - xss in title is still alert cookie
https://surveyjs.answerdesk.io/internal/ticket/details/T17086

[JaneSjs]

+1 T17109 - Application is vulnerable to Cross-Site Scripting attack.
https://surveyjs.answerdesk.io/internal/ticket/details/T17109

[srop]

@JaneSjs @novikov82

Thank you for new version to v1.9.133. I try again but that issue is still found, when i ctrl+v >"><img src="x:x" onerror="alert(document.cookie)"> this script on surveyjs creator at survey title . You can try on your website . Please help to fix ASAP because i cannot deploy on my production .

Thank you

[novikov82]

@srop We updated our site with new version about 1 hour ago. Please try again.