AIKIDO-2025-10857

TL;DR

Affected versions of this package are vulnerable to injection attacks due to overly permissive regular expressions within the flag for stripping <script> and <style> tags. An attacker can exploit this by injecting a malformed tag where the inner, unclosed substring causes the regex to match too much or too little, allowing the malicious JavaScript payload to remain in the output and execute in a victim's browser.