Stored XSS exists in the tree mode of jsoneditor prior to 9.0.2 through injecting and executing JavaScript.
jsoneditoronline jsoneditor