Onlook Web Application DOM-Based Cross-Site Scripting Vulnerability in Text Editor Feature

A DOM-based Cross-Site Scripting vulnerability has been identified in the text editor feature of the Onlook web application, version 0.2.32. This issue arises because user input is not adequately sanitized before being injected into the DOM using innerHTML, when editing text elements. As a result, an attacker can exploit this vulnerability to inject malicious HTML and script code. The injected scripts are executed within the context of the preview iframe, potentially allowing the execution of arbitrary scripts in the user's session.

Impact

Exploitation of this vulnerability allows for DOM-based Cross-Site Scripting, where injected scripts are executed in the context of the user's session, potentially leading to unauthorized actions or data exposure.