CVE-2018-16330: Pandao editor.md vulnerable to XSS in IMG attributes

The vulnerability manifests in how image attributes are processed during markdown-to-HTML conversion. The provided XSS payload demonstrates that event handlers in IMG attributes (like onerror) are not properly sanitized. This indicates the markdown parser's image handling function lacks adequate attribute filtering/escaping. While exact function names aren't available in public disclosures, the core issue resides in the image parsing logic of the markdown processor, as confirmed by the XSS execution through malformed IMG elements.