AIKIDO-2026-10140

TL;DR

Affected versions of this package improperly embed user-controlled input into an HTML attribute without output encoding, allowing reflected XSS via the return parameter; an attacker can craft a malicious URL where return contains injected quotes and script payloads, which are rendered into the hidden input and executed in the victim's browser when the page loads or when the value is later consumed by client-side code.