Visual Editor openLink → javascript: on create.netlify.com
The preview iframe is allowed to post openLink. The studio checks source and origin, then calls window.open(data, "_blank") with no scheme allowlist. A javascript: URL runs as the logged-in Visual Editor session. The session cookie is HttpOnly, so the proof reads GET /api/v1/user with that session.
Target
create.netlify.com
Sink
window.open(message.data, "_blank") on type: "openLink"
Root Cause
Origin check accepts the preview iframe, then the URL scheme is not restricted. script-src is report-only.
Impact
One gesture in the preview runs script as whoever has the editor open and returns that account's email and id.
Interaction
Open the editor, then one click on CLICK HERE inside the preview.
Reproduction steps:
Sign in to Netlify in this browser, on the account that owns the test project.
Click one of the buttons below. A popup opens the Visual Editor.
In the preview, click CLICK HERE (or the alert button).