AIKIDO-2025-10273

TL;DR

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to insufficient input sanitization in the $message variable, which is rendered within the div element for error messages. An attacker can exploit this flaw by injecting malicious JavaScript code into the $message parameter, which will then be executed in the context of a victim's browser when the error message is displayed. It could lead to session hijacking, defacement, or other client-side attacks.