AIKIDO-2026-10304

TL;DR

Affected versions of this package improperly rendered user-controlled content directly into the DOM using mechanisms such as v-html, innerHTML, and unsanitized HTML returned by marked, enabling the injection of arbitrary HTML or JavaScript. Without proper sanitization or escaping, attacker-supplied input could be interpreted as executable markup instead of plain text. An attacker could exploit this by injecting malicious payloads (e.g., <script> tags, event handlers, or crafted HTML) into fields rendered by these components, leading to Cross-Site Scripting (XSS) that executes in the victim's browser, allowing session theft, credential harvesting, or arbitrary actions on behalf of the user.