AIKIDO-2026-517140

TL;DR

Affected versions of this package are vulnerable to stored cross-site scripting (XSS). Clerk auth state is serialized with JSON.stringify into SSR <script> tags, so a </script> sequence in user-controllable session claims can break out of the script element and execute attacker-controlled JavaScript. The patch escapes <, >, and / (via htmlSafeJson) while preserving identical JSON.parse values on the client.