AIKIDO-2026-508122

TL;DR

The escapeAttrValue helper in @bbob/plugin-helper neutralizes dangerous URL schemes such as javascript, data, vbscript, and file by encoding the scheme colon, but it matches the scheme with a contiguous-token regular expression. A control character such as a tab, newline, or carriage return placed inside the scheme keyword breaks the match while browsers still strip those characters and resolve the URL as that scheme. When user-controlled text is written into an HTML attribute value this produces an href that executes script when the link is activated, resulting in cross-site scripting. The fix strips ASCII control characters from the value before applying the scheme guard.