AIKIDO-2025-10597

TL;DR

Affected versions of this package are vulnerable to Cross-Site Scripting (XSS) due to improper sanitization of the place_name input in the geocoder suggestion render function. An attacker can exploit this by crafting a malicious payload containing executable JavaScript as part of the location name (e.g., ><img src=x onerror=alert(1)>), which would execute immediately when rendered in the user's browser, potentially compromising user sessions or stealing sensitive data. It violates the trust boundary between user-supplied content and rendered output, requiring no user interaction beyond triggering the geocoder suggestion dropdown.