AIKIDO-2025-10102

TL;DR

Affected versions of the package allow attackers to execute Cross-site Scripting (XSS) attacks by exploiting DOM clobbering in the PickList component. DOM clobbering is a code-reuse attack where an attacker injects seemingly benign, non-script HTML markup (e.g., through a post or comment) into a webpage. The attacker then leverages existing JavaScript code (gadgets) to transform the injected content into executable code. This vulnerability can lead to XSS on websites that include Webpack-generated files and allow users to inject certain scriptless HTML tags.