HackerOne Bug Bounty Disclosure: arbitrary-post-request-as-victim-user-from-html-injection-in-jupyter-notebooksbyjoaxcar