CVE-2024-29504: Summernote vulnerable to cross-site scripting

The vulnerability stems from inadequate input sanitization when processing codeview content. The GitHub PR #3782 reveals that the core issue was in the dom_value function's lack of HTML entity escaping for &, <, and > characters. Additionally, the Codeview.toggle function's handling of raw HTML during mode switching (as demonstrated in the PoV with <script>alert(1)</script> payload) directly executes untrusted input. The patch attempts to address this by adding character escaping in dom_value, confirming these functions' roles in the vulnerability chain.