Stored XSS in IE11 on hackerone.com via custom fields

Summary

Hi @security,

Steps:

1-The affected program is enabled with a Hacker Facing Custom Fields feature: https://hackerone.com/:handle/custom_fields

Custom Fields >> Hacker Facing Custom Fields >>new field with a title name (hello) >>
Select type : text >> Visibility; Hacker facing - this field will appear on the report for the hacker to complete

2-Then a malicious user report a bug to that program and put this payload "><img src=x onerror=alert(document.domain)> to Additional information field in the report and then submit the report.

3-when the program admin open the attacker report and doing this actions [edit or modify or change and save it] to the value of the attacker in report(Custom data - hacker facing) field as a result a stored xss issue happen. {F1277066}

Poc: https://hackerone.com/reports/1173040#activity-11548302

i think this issue happen when rendering the report data via : ==updated custom field (from) the attacker value (to) a new value both values in (from) & (to) are not sanitized from malicious code so the attacker malicious payload executed there.==

{F1277062}

==so even if the program admin have changed the attacker payload in the report (Custom data - hacker facing) field in order to prevent the attacker code from execute, the attacker payload will be saved in the report data for ever in (from) value and the attack going to work permanently.==