AIKIDO-2026-28946

TL;DR

Stempler is the framework's default template engine and applies context-aware escaping to values echoed with the auto-escaping output syntax. For JavaScript event-handler attributes such as onclick and other on* handlers, the finalizer HTML-entity-encodes the value and wraps it in quotes instead of encoding it as a JavaScript literal. Because the browser HTML-decodes an event-handler attribute before the JavaScript engine parses it, user-supplied quotes are decoded back and can break out of the JavaScript string, yielding reflected or stored cross-site scripting through the supported safe syntax. The fix serializes the value with json_encode using the JSON_HEX_* flags and HTML-encodes the resulting literal so it survives both HTML and JavaScript decoding.