AIKIDO-2025-10110

TL;DR

Affected versions of this package are affected by improper input validation. It fails to escape data properly and lacks a strict Content Security Policy (CSP). This vulnerability allows attackers to inject malicious payloads, leading to cross-site scripting. As a result, an attacker can steal session cookies, exfiltrate sensitive data, or perform unauthorized actions on behalf of users. The absence of CSP further increases the risk by permitting inline scripts and event handlers to execute freely.