An authenticated Editor user can execute scripts by storing crafted attachment MIME types, such as `text/html;image/png`. This is achieved by writing values through the records API, which causes the `/dltemp` signed URL to serve HTML inline. This allows for the theft of session tokens from `localStorage` to impersonate victims.