X4Sh3S

Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

A Stored Cross-Site Scripting (XSS) issue existed in Notesnook’s editor embed component when processing Twitter/X embed URLs. The `tweetToEmbed()` function within `component.tsx` directly incorporated user-provided URLs into an HTML string without proper escaping before assigning it to the `srcdoc` attribute of an `<iframe>`. This allowed for the injection of malicious scripts.