Administrator account takeover via unsanitized study description

Stored XSS in JATOS 3.9.3 allows remote authenticated users to execute scripts in an administrator's browser through a crafted study description. The submitDescription handler accepted raw Markdown without StudyProperties HTML validation, and the study-description view rendered the stored markup as active content. A user able to edit a study and assign it to an administrator must induce that administrator to open the description; the script then acts through the administrator's JATOS session, enabling account takeover and unauthorized actions.