AIKIDO-2025-10811

TL;DR

Affected versions of this package are vulnerable to DOM Clobbering due to insufficient validation of script tags in the URL resolution logic. The getImportMetaUrl function insecurely relies on document.currentScript and document.baseURI without proper sanitization, allowing attackers to inject malicious HTML elements that override these properties. An attacker could exploit this by clobbering document.currentScript.src or document.baseURI with controlled values, potentially redirecting script imports to arbitrary malicious URLs and enabling cross-site scripting (XSS) or code execution.