XSS Vulnerability in Javascript: string #709

Test Environment
Google Chrome - Version 75.0.3770.142 (Official Build) (64-bit)

Description
A malicious actor may insert and finally execute malicious Javascript code.

Steps to reproduce

1. Go to https://pandao.github.io/editor.md/en.html or any open editor.md apps
2. In the edit mode, input the following malicious code snippet:

[xss poc](Javascript:alert("pzyc0 poc xss with cookie: " + document.cookie))

Impact
If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user.

Expected Results
No malicious Javascript code should be executed

Remediation
In general, it is highly recommended to implement input validation, output sanitization and escaping.

Proof-of-Concept