AIKIDO-2025-10053

TL;DR

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) through the layout_options parameter due to improper sanitization of user input in the setContent function. An attacker can inject malicious JavaScript into unsanitized DOM elements, which are later rendered by the client, allowing the execution of arbitrary scripts in the context of the user's session. Exploiting this vulnerability requires the attacker to have permissions to modify or create presets for other users or to chain the attack with another vulnerability to escalate privileges.