AIKIDO-2025-10416

TL;DR

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in anchor tags due to inadequate validation of the href attribute during link rendering. Attackers can exploit this by injecting malicious JavaScript URIs into the href parameter, which executes arbitrary code when users click the compromised link. It occurs because then renderHTML() function merges user-supplied attributes without sanitizing dangerous URL schemes, allowing DOM-based XSS attacks. Successful exploitation could lead to stolen sessions, redirecting users, or performing actions on behalf of authenticated victims.