AIKIDO-2025-10320

TL;DR

Affected versions of this package are vulnerable to Cross-Site Scripting (XSS) in the Custom HTML Template feature due to insufficient validation of the message origin in postMessage communications. An attacker could exploit this flaw by hosting a malicious website that sends crafted JavaScript payloads via postMessage to the vulnerable application, which would then execute the script in the context of the target domain. Since the application did not verify the sender's origin, any website could send arbitrary scripts, potentially leading to session hijacking, data theft, or unauthorized actions on behalf of the user.