AIKIDO-2026-10303

TL;DR

Affected versions of this package allowed unvalidated user-controlled URLs to be passed directly to window.open, enabling arbitrary schemes such as javascript: or data: to be executed in a new browser context. This could allow an attacker to craft a malicious payload.url that executes JavaScript or redirects users to phishing pages when the link is opened. By injecting a specially crafted URL into the event handler, an attacker could trigger client-side script execution or malicious navigation. The patch mitigates this by parsing the URL and restricting navigation strictly to the https: protocol.