AIKIDO-2025-10440

TL;DR

Affected versions of this package are vulnerable to Cross-Site Scripting (XSS) due to improper sanitization of HTML content in the extractPages function. The function used to extract .page elements returns either raw HTML or text without sanitizing user-supplied input, allowing attackers to inject malicious scripts. An attacker could exploit this vulnerability by crafting a payload within a .page element, which would then be rendered unsanitized in the browser, allowing arbitrary JavaScript to execute in the context of the victim's session. It could lead to session hijacking, data theft, or other malicious actions.