carousel-press

This is a slide-rendering utility with a significant HTML injection flaw: untrusted frontmatter `accent` is inserted raw into an HTML style block. A malicious deck can inject script into the headless Chrome rendering context, with potentially increased impact due to the Chrome flags. This is a user-input-triggered vulnerability; the fragment does not itself establish intentional malware or data theft.