Arbitrary file read via unsanitized event handlers

Cross-site scripting in Joplin 1.0.184 and earlier allows remote authenticated users to read arbitrary local files through crafted note content. The Markdown and HTML renderers fail to remove event-handler attributes such as onerror from untrusted image markup, so rendered notes execute attacker-supplied JavaScript in the desktop application's privileged context. The attack requires malicious note content to reach the desktop client and be rendered by a user; the script can disclose files accessible to the Joplin process.