AIKIDO-2026-10259

TL;DR

Affected versions of this package contain a Cross-Site Scripting (XSS) vulnerability in the layered navigation filter search, where user-supplied input is rendered without proper escaping, allowing arbitrary JavaScript execution in the browser. An attacker can exploit this by injecting malicious script payloads into the filter search field, leading to execution of attacker-controlled code in victims’ sessions. This may enable session hijacking, credential theft, or unauthorized actions performed on behalf of the user. The issue is caused by unsanitized rendering of search input, which was later fixed by properly escaping user input before display.