AIKIDO-2025-10234

TL;DR

Affected versions of this package are vulnerable to Cross-Site Scripting (XSS) attacks via email notification content due to improper sanitization of the getHtmlBody() method, as well as when importing forms with manipulated field content that renders unsanitized user input. An attacker can exploit these issues by injecting malicious scripts into email notifications or form fields, which are then executed in the victim's browser when the content is rendered, potentially leading to session hijacking, data theft, or arbitrary code execution.