vditor vulnerable to Cross-site Scripting

Vditor, a Markdown editor, has a security flaw where malicious code can be executed if someone tricks you into copying and pasting it into the editor. This could allow attackers to steal your data or take control of your session.

Vditor prior to version 3.8.7 is vulnerable to stored/paste-based XSS where unsanitized content from clipboard operations is rendered without proper validation. The attack requires social engineering to convince the user to copy malicious payload into the editor, resulting in arbitrary JavaScript execution in the victim's browser context.