XSS vulnerability found in the Wechatsync markdown preview page

[jackfromeast]

Hi, Wechatsync developer!

Currently, the markdown rendering page does not sanitize user input for scripts, which can lead to Cross-site Scripting (XSS) in the markdown preview page.

Payload

<img src=1 onerror="javascript:alert(document.domain)">

PoC

Impact

Users of Wecharsync who open untrusted markdown files on the platform (i.e., https://www.wechatsync.com/md/) are vulnerable to XSS attacks.

Note that, since the project doesn't set the security policy, I directly report the vulnerability here.