XSS vulnerability due to missing restrictions on HTML attributes

Checklist

• I've looked at the documentation to make sure the behavior isn't documented and expected.
• I'm sure this is an issue with Summernote, not with my app or other dependencies (Angular, Cordova, React, etc.).
• I've searched through the current issues to make sure this hasn't been reported yet.
• My issue is pertinent to this repository of Summernote (jQuery), or I was unable to have my issue resolved from the relevant version I'm using, such as Angular, dJango, Rails or React. Please try your issue at the relevent repository first.
• I understand that issues without interaction for more than 14 days (2 weeks), may be closed at our discretion. We do this, as sometimes issues are abandoned. We may at our discretion, add issues to the relevant project to be looked at, or for maintainers to work through as time permits. This is to help keep issues relevant to the current version of Summernote, and to reduce clutter.
• I agree to follow the Code of Conduct that this project adheres to.

Steps to reproduce

1. Go to the following website for testing: https://summernote.org/

1. Click the Code View button and enter the following payload. <img src=x onerror=alert(document.cookie)>

2. Now, if you check, the user's session has been successfully displayed.

Expected behavior

Due to the lack of proper restrictions on the img tag's attributes, it becomes possible to execute XSS payloads. As a result, an attacker could cause serious damage to services using Summernote — including open redirect XSS, session hijacking, and more.

Current behavior

Widely used web editors like TinyMCE typically restrict potentially dangerous attributes and functions that could lead to XSS attacks by default. While Summernote also appears to perform some filtering on specific tags, certain attributes do not seem to be subject to these restrictions.

Therefore, HTML tags provided by users should be properly escaped in the source code. A whitelist-based approach should be implemented — allowing only specific, safe tags to bypass escaping — while adding filtering logic to block the use of dangerous attributes.

Minimal example reproducing the issue

No response

Environment

• Summernote version: Summernote v0.9.0
• Browser (with version): Chrome 135.0.7049.115
• OS/Platform (with version): window 11 pro