Poc:

1. Click on the code </> icon
2. Insert into the textarea the following payload <img src="#" onerror=alert(2)>
3. Press again on the </> icon to see the preview
4. An alert that prints 2 appears.
   To solve the issue it may be useful to pre-parse the html tags which allows javascript execution and then render them sanitized.