AIKIDO-2026-10565

TL;DR

Affected versions of this package improperly handled redux store names in rendered HTML attributes, allowing unsafe store keys to break out of the intended attribute context and potentially trigger attribute injection. An attacker able to influence a store name could craft malicious input that injects unexpected HTML attributes or script-capable handlers into the page, which may lead to client-side code execution or other unsafe DOM manipulation when the component is rendered.