AIKIDO-2026-10218

TL;DR

Affected versions of the package are vulnerable to insufficient content sanitization in certain parsing scenarios. HTML-like content embedded in comments and legacy patterns may not be sanitized strictly enough when processed, potentially allowing cross-site scripting (xss) if malicious markup is rendered. The issue is mitigated by updating dependency versions and strengthening parsing logic to enforce stricter sanitization when xss_sanitization is enabled (default). Additionally, a new allow_html_in_comments configuration option provides explicit control over whether HTML-like syntax in comment nodes is permitted, reducing the risk of unintended script execution.