Youtube onebox not sanitised

[Salamander (Samuel)]

XSS exploit on mouse over

[zogstrip]

Thanks for reporting that issue @Salamander.

I’m unlisting this since this is a valid XSS.

I’ll have a look tomorrow unless @sam gets to it before

[codinghorror (Jeff Atwood)]

Title of the video is

DiscoExploitTest" onmouseover="alert('Yes? Yes')"

[zogstrip]

Thanks @Salamander, I just pushed a fix

SECURITY: fix XSS in lazyYT plugin

[sam (Sam Saffron)]

Note, fix is backported to beta and stable, closing this, flag to reopen if still having any issues.