AIKIDO-2025-10891

TL;DR

Affected versions of this package are vulnerable to Cross-Site Scripting (XSS) via Unsanitized Img Tag Event Handlers, where the HTML sanitizer's previous configuration (allowedAttributes: false) for img elements improperly allowed dangerous event handler attributes like onerror, onload, and onclick. This flaw enables attackers to inject malicious img tags with such event handlers, executing arbitrary JavaScript when triggered, for instance, using onerror to run code upon failed image loading, which can lead to session hijacking, data theft, or other malicious actions in the victim's browser.