AIKIDO-2026-900777

TL;DR

The UnsplitNucleotideRenderer in the macromolecule canvas renders a monomer's label into an SVG foreignObject using a d3 .html() call that interpolates the label directly into markup. When a structure file such as a KET file contains a monomer whose label holds HTML or script, that content is parsed as markup instead of being shown as text. As a result, an attacker who supplies a crafted structure file can execute arbitrary script in the context of the application that embeds Ketcher. The fix renders the label with .text() on a dedicated xhtml:div, so label content is always treated as plain text.