AIKIDO-2026-10767

TL;DR

Affected versions of this package are vulnerable to cross-site scripting (XSS) because untrusted input was previously written to the DOM using innerHTML, allowing attacker-controlled HTML or script-capable markup to be interpreted by the browser. This issue was fixed by replacing innerHTML with textContent, which renders the input as plain text instead of executable markup. An attacker might exploit this by supplying crafted input that injects malicious script or event handlers into the page, potentially leading to session theft, account takeover, or unauthorized actions in the victim’s browser.