AIKIDO-2025-10401

TL;DR

Affected versions of this package are vulnerable to Mutation Cross-site Scripting (XSS) due to improper escaping of < and > characters in HTML attributes during serialization, allowing attackers to inject malicious scripts when user input is rendered. An attacker could exploit this by crafting a payload inside an attribute, which, if unescaped, could break out of the attribute context and execute arbitrary JavaScript in the victim's browser. This occurs when the browser's HTML parser misinterprets the unescaped characters as markup, leading to DOM mutation and script execution.