AIKIDO-2025-10671

TL;DR

Affected versions of this package are vulnerable to Cross-Site Scripting (XSS) due to improper input validation in the checkAttribute function. This validation can be easily bypassed because attackers have various ways to execute scripts without relying on well-known evasion characters. For example, an attacker can inject event handlers like onclick or onmouseover without any whitespace (e.g., <img/src=x onerror=alert(1)>). They may also use alternative encoding methods, such as HTML entities, or exploit other HTML elements and attributes that are not properly sanitized. As a result, attackers can execute malicious JavaScript in the victim's browser.