AIKIDO-2025-10283
@stripe/connect-js is vulnerable to HTML Clobbering
20
CVE Score
Low
HTML Clobbering
TL;DR
Affected versions of this package are vulnerable to HTML clobbering, where malicious HTML elements can interfere with the initialization of connect.js. If the host page's <head> contains nested <a> tags with id= StripeConnect and name= init, it may falsely assume connect.js is initialized. An attacker can inject HTML like <a id='StripeConnect'><a id='StripeConnect' name='init' href='stripe'></a></a>, leading to improper script execution, security bypasses, or other unintended behaviors.
How do I fix this?
Upgrade the @stripe/connect-js library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Package
Versions
3.0.0 - 3.3.22
Fixed in 3.3.23Background info
@stripe/connect-js is vulnerable to HTML Clobbering in versions 3.0.0 - 3.3.22.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.