BUG: Component attributes data not sanitized properly leading to self XSS

[DevKishan]

GrapesJS version

• I confirm to use the latest version of GrapesJS

GrapesJS MJML version

• I confirm to use the latest version of GrapesJS MJML

What browser are you using?

Chrome 126

Reproducible demo link

https://grapesjs.com/demo-mjml.html

Describe the bug

How to reproduce the bug?

1. Go to https://grapesjs.com/demo-mjml.html
2. Select any component
3. Set component's id attribute's value to 123"></div><img src=x onerror=alert(1)>123

What is the expected behavior?
... The XSS code in the attribute's value should be sanitized and removed.

What is the current behavior?
... The XSS code executes and triggers an alert(as seen in this video). This happens only with GrapesJS MJML node module. With core GrapesJS editor the issue doesn't occur as seen here on core editor demo site.

Code of Conduct

• I agree to follow this project's Code of Conduct