AIKIDO-2025-10451

TL;DR

Affected versions of this package are vulnerable to Cross-Site Scripting (XSS) due to improper URL validation in the URL sanitization function. The function only checks for URLs starting with http://, https://, or www., returning them unmodified or prepending https:// to www. inputs, while returning undefined for all other cases. Suppose the calling code falls back to the original unsanitized input when undefined is returned. In that case, an attacker can exploit this by supplying a malicious javascript: URL (e.g., javascript:alert(document.cookie)), which executes arbitrary code in the victim's browser when triggered.