AIKIDO-2026-885111

TL;DR

@bbob/html renders BBCode to HTML and builds element attributes through attrsToString, which relies on escapeAttrValue to neutralize dangerous URL schemes such as javascript: on the default render path. The scheme guard only matches a contiguous scheme token, so a control character placed inside the scheme keyword breaks the match while browsers still resolve the URL. User-controlled BBCode such as a [url] value containing java script: reaches an href unescaped and runs script when the link is followed. The fix strips ASCII tab, newline, and carriage-return characters before the URL-scheme guard runs.