AIKIDO-2026-10330

TL;DR

Affected versions of this package do not sanitize the inner content of iframe srcdoc attributes. DOMPurify sanitizes the outer HTML but treats srcdoc as a plain string, so an attacker can inject markup such as <iframe srcdoc="<script>...</script>"></iframe> to execute JavaScript in the page context or mount phishing content in the Transcript Editor. The patch adds a post-processing step that sanitizes each srcdoc value with DOMPurify and introduces iterative sanitization until output stabilizes to reduce nested-tag bypasses.