AIKIDO-2025-10500

TL;DR

Affected versions of this package are vulnerable to Cross-site scripting (XSS) via unsanitized URL injection in the history.pushState function. The vulnerability occurs when window.location.href is directly embedded into the HTML template without proper encoding, allowing attackers to craft malicious URLs containing JavaScript payloads. When a victim visits a manipulated link (e.g., https://victim.site/?"></script><script>alert(document.cookie)</script>), the payload executes within the application context, enabling session hijacking, data theft, or malicious actions.