XSS through document projects

How it was found

Hello, I'm Ethan Luis McDonough (@elmt2 on Khan Academy), and I found a way to inject scripts into document projects. Since KA document projects output HTML, I can edit the PUT request that updates projects (https://www.khanacademy.org/api/internal/scratchpads/ID) and inject JavaScript code inside an <img> tag's onload attribute. Here's a demo that completely redirects a learner from KA to another site: https://www.khanacademy.org/physics/woah/4740384569491456.

Note: the stored script does not run in Firefox because document projects don't seem to be working on that browser (at least on my machine).