AIKIDO-2026-553599

TL;DR

The <o:hashParam> component writes URL fragment names and values back into a JavaScript callback in the ajax response without escaping them for a JavaScript string context. A crafted link whose fragment contains a single quote can terminate the string literal and inject arbitrary script that runs when a victim opens the page. Exploitation requires the victim to open an externally supplied link, so user interaction is needed. The fix escapes both the parameter name and value for JavaScript strings before writing them into the callback.