AIKIDO-2026-10407

TL;DR

Panel's bundled panel.js (built from TypeScript in panel/models/) had two security issues. In formatError in util.ts, code displaying syntax errors used code.replace(">", "&lt;").replace("<", "&gt;"), which only escapes the first occurrence of each character; code containing multiple angle brackets could break rendering or allow XSS when error output was shown. In the Plotly model (plotly.ts), column resolution for object data used a path derived from column names to set properties on the trace object without validating keys; a crafted path (e.g. containing __proto__ or constructor) could overwrite the prototype. The fix adds global regex escaping in formatError and validates path segments against a forbidden-key set, using Object.hasOwn and safe path resolution for Plotly.