AIKIDO-2026-10531

TL;DR

Affected versions of this package do not properly validate or intercept drag-and-drop content before it is inserted into the editor, allowing potentially malicious content to be dropped and processed without a prevention hook. An attacker could exploit this by tricking a user into dragging crafted HTML or active content into the editor, which may result in unsafe content being rendered, persisted, or later executed depending on downstream sanitization and usage. The patch introduces a beforeDrop event so applications can inspect and block dangerous payloads before the drop is accepted. This reduces the risk of content injection and editor-based XSS-style attack chains.