AIKIDO-2025-10770

TL;DR

Affected versions of this package are vulnerable to XML injection due to incomplete entity escaping, specifically the lack of proper escaping for the > character in the text() function, and insufficient attribute name validation, which could allow an attacker to exploit this by crafting malicious inputs that bypass escaping mechanisms, leading to CDATA injection or the insertion of invalid attributes, potentially resulting in data manipulation, denial of service, or arbitrary code execution in XML-processing contexts.