AIKIDO-2025-10104

TL;DR

Affected versions of this package are affected by security misconfiguration that allows Cross-Site Scripting (XSS) due to a missing restriction on iframe embedding. The affected object validation does not safely enforce the frame-ancestors secure directives, allowing external domains to load the popup within an iframe. If the popup processes user-controlled input without proper sanitization or encoding, an attacker can inject and execute JavaScript, resulting in session hijacking, clickjacking, or other client-side exploits.