AIKIDO-2026-752978

TL;DR

The HTML report exporter in graphify/exporters/html.py builds the neighbor focus links by dropping a node id straight into a double-quoted inline onclick attribute in the generated graph.html. Node ids and labels sourced from documents or from titles scraped via graphify add can contain a double-quote, which truncates the attribute and lets a hostile source inject a live event handler into the report. When a user opens the exported report locally, the injected handler executes as stored cross-site scripting. The fix carries the id in an HTML-escaped data-nid attribute dispatched through a single delegated click listener, removing the injection vector.