Stored CSS Injection

When creating a product, users can upload a logo. The logo_url was not escaped properly, allowing an attacker to inject malicious characters into a style tag. This vulnerability did not allow for XSS due to our CSP, however, it did allow for CSS injection.