AIKIDO-2026-722686

TL;DR

@bbob/preset-html5 defines the default HTML5 tag set, and its [url] tag emits an anchor whose href comes from user input and is sanitized by escapeAttrValue. The URL-scheme guard only matches a contiguous scheme token, so control characters inside the scheme keyword bypass it while browsers still resolve the URL. A [url] value containing java script: therefore renders an href that runs script when the link is followed. The fix strips ASCII tab, newline, and carriage-return characters before applying the scheme guard.