There is XSS in browser/components/MarkdownPreview.js in BoostIO Boostnote 0.11.15 via a label named flowchart sequence gallery or chart as demonstrated by a crafted SRC attribute of an IFRAME element a different vulnerability than CVE-2019-12136.