problem

Segment editing allows XSS attacks. Ordinary attack vectors (img onload, script tags) are recognized and prevented already. 

Additional vectors were found. See PDF in linked TS Issue. 

solution

Include a more sophisticated lib to filter out the described, other possible attack vectors. Allow only the needed HTML in segment content.