AIKIDO-2026-10838

TL;DR

Translated HTML sanitization is meant to block script execution when interpolation is rendered with v-html and escapeParameterHtml is enabled. Earlier releases only neutralized plain javascript: URLs in a few attribute and style patterns, so entity-encoded colons and other obfuscated scheme spellings could still survive parsing and reach the DOM as executable navigation targets. The sanitizer now recognizes encoded javascript schemes, rewrites dangerous URL attributes and CSS url() values to about:blank, and covers unquoted URL attributes. Regression tests lock in entity-encoded and style-based cases after DOM parsing.