AIKIDO-2025-10683

TL;DR

Affected versions of this package are vulnerable to Cross-Site Scripting (XSS) due to insufficient escaping of user input in dynamic DOM selectors and JavaScript contexts, which could allow an attacker to inject malicious scripts through crafted inputs. This vulnerability stems from the lack of proper sanitization in component and store script generation, enabling arbitrary code execution. An attacker might exploit this by manipulating dynamic IDs without CSS.escape() or submitting unescaped user data that executes in other users' browsers, potentially leading to session hijacking or data theft.