Oneclick stored xss via vcard nickname

[moshiax]

Nickname from vCard can be rendered as html without escaping

poc

1. Set attacker account nickname to this:

<img src=x onerror=alert(1)>

2. Send a contact invite to victim account
3. Victim account accepts contact request
4. Payload executes