AIKIDO-2025-10200

TL;DR

Affected versions of this package are vulnerable due to incomplete URL sanitization in meta tags (such as canonical and related URLs), where user input was not correctly escaped or validated. An attacker could craft a malicious payload with a manipulated canonical or related URL parameter (e.g., ?redirect=javascript:alert(1) or ?next=evil.com), tricking users into visiting phishing sites or executing arbitrary scripts in their browser context, bypassing existing protections.