AIKIDO-2025-10483

TL;DR

Affected versions of this package are vulnerable to Cross-Site Scripting (XSS) where server-side rendering fails to escape double quotes within attribute values, resulting in invalid HTML that disrupts the page structure. An attacker could exploit this by injecting double quotes into controlled attribute values to break out of the attribute context and append malicious attributes or event handlers, potentially enabling XSS attacks when browsers parse the corrupted HTML. This could compromise user sessions, steal sensitive data, or perform unauthorized actions in the victim's security context.