Stored XSS was discovered in the tree mode of jsoneditor before 9.0.2 through injecting and executing JavaScript.
Published January 11, 2021.
Jsoneditoronline Jsoneditor