According to Lucas Soares' Medium article from March 2024, there is a vulnerability in the Froala codebase (even in the latest v4.1.4) that allows HTML injection and XSS. This might be averted with a server-side validation of the input data.

[https://medium.com/itnext/outsystems-security-the-vulnerable-text-editor-that-empowers-hackers-do-you-use-it-93221c907528]