AIKIDO-2026-10096

TL;DR

Affected versions of this package are vulnerable to a cross-site scripting (XSS) attack via the id prop in the Banner component, where the code unsafely interpolated user-controlled id values into a localStorage getter string without sanitization, allowing an attacker to inject malicious JavaScript by crafting an id that breaks out of the string literal and executes arbitrary code. An attacker could exploit this by supplying a malicious id payload, which would run in the victim's browser upon component rendering, potentially leading to data theft or session compromise. The patched code prevents this by using JSON.stringify to properly encode the id value, ensuring it is treated as a safe string literal.