question_image.ts in SurveyJS Form Library before 1.10.4 allows contentMode=youtube XSS via the imageLink property.

Published May 18, 2024 · Updated Feb 13, 2025 · Assigned by mitre