Cervantes through 0.5-alpha allows stored XSS.
{
"versions": [
{
"introduced": "0"
},
{
"last_affected": "0.3-alpha"
},
{
"introduced": "0"
},
{
"last_affected": "0.4-alpha"
},
{
"introduced": "0"
},
{
"last_affected": "0.5-alpha"
}
]
}