The tool's HTML preview mechanism had a flaw allowing malicious JavaScript to access local files and exfiltrate cloud ...