Open
Description
Codimd seems to support custom CSS. This opens the door to adding malicious CSS payloads. On the harmless end, this would be an example:
body { opacity: 0; }Do server admins currently have the ability to disable custom CSS?
In cases where the feature is enabled, I suggest you employ a sandboxing approach; moving the displayed markdown to inside an iframe and leaving this issue open to track the implications of custom CSS and develop novel sandboxing ideas.