This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4,…

This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0…

In Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that i…

If frame 0 allocates storage for a narrow mode such as `L`, and a later frame of the same dimensions switches…

This vulnerability is due to the use of persistent cookies. Addi…

This issue affects Apache Answer: through 2.0.2.

The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own …

**Researcher**: Alex Bouffard (mixbo@pebwalker.com)

### Summary

A heap buffer overflow in Pillow's FlashPix (FPX) JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with `Image.open()`. The file is recognized by …

Echo's Proxy middleware selected a raw tunnel when the client requested a WebSocket upgrade, before validating whether the configured upstream accepted it. If the upstream returned an ordinary HTTP response and kept the connection alive, subsequent HTTP requests on that connection were fo…

A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a `use cache` function that returns multiple typed arrays.

## Workaround

There is no known workaround for affected applications with such `use cache` fu…

When DOMPurify is configured with `SAFE_FOR_TEMPLATES: true` together with a DOM-returning mode (`RETURN_DOM: true`, `RETURN_DOM_FRAGMENT: true`, or `IN_PLACE: true`), template expressions such as `{{…}}`, `${…}`, and `<%…%>` survive sanitization inside the text content of an attac…

The `tunnelRoute` option makes the SDK send browser events to a path on your own Next.js server (for example `/monitoring`), where a rewrite forwards them to Sentry to prevent ad blockers from blocking them. To keep those envelope requests from being rejected by your middleware, the SDK …

A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.

## Workaround

Ensure the version of `sharp` used by Next.js is greater than or equal to `0.35.5`…

The ESM compiler in `happy-dom@20.14.5` does not validate imported local binding aliases before interpolating them into generated JavaScript.

As a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed.

This appears…

ksmbd: remove stale channels from all sessions on teardown

ksmbd_sessions_deregister() removes a connection's channels from other
sessions' channel lists only while conn->binding is still set:

if (conn->binding) {
hash_for_eac…

Jupyter Server's gateway WebSocket handler checks that a user is authenticated, but it does not ask the configured Authorizer whether that user may execute kernels.

In Jupyter Server 2.0.0 through 2.5.0, enabling GatewayClient.url automatically replaced the normal kernel channel handle…

Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID

Copy the content of a Periodic Advertisement Report to BASE only if
the service UUID is Basic Audio Announcement Service UUID.

This issue affects Apache Camel: from 4.4.0 before 4.18.5, from 4.19.0 before 4.22.1.

…

Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstream_request_filter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop headers, or the headers Connection nominated, although RFC 9110 Sect…

Experimental tasks are deprecated. The 2026-07-28 specification replaced them with a red…

This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1.

The camel-oauth processors that guard a route did not stop the exchange when authentication could not be completed. Where a failure to e…

Every Pillow wheel from 11.1.0 onward bundles a libopenjp2 containing a heap-buffer-overflow **write** that is fixed upstream on master but has never appeared in an OpenJPEG release. See https://osv.dev/vulnerability/OSV-2025-219

Because the wheel bundles its own copy, a patched host O…

netfilter: ipset: mark the rcu locked areas properly

When we bump the uref counter, there's no need to keep
the rcu lock because the referred hash table can't
disappear. Also, from the same reason in mtype_gc we
need the rcu lock …

wifi: iwlwifi: mvm: fix sched scan IE sizing

Scheduled scan built the probe request before iwl_mvm_scan_fits(),
so oversized IEs could be copied into the fixed preq buffer before
length validation. Move iwl_mvm_build_scan_probe() …

While libxml2 is expanding an internal entity, a recursive XInclude
can parse anoth…

A destination path supplied to virtualenv can be interpreted as shell syntax by a generated POSIX console launcher. The
app-data seeder and pip delegate launcher generation to distlib but supply the interpreter path in a form that does not
preserve it as literal data in the shell wrapper…

The bash `activate` script escapes the environment name for only one of the two passes bash makes over `PS1`, so a
backslash in the name undoes the escaping and a name containing `\$(…)` runs as commands in the user's shell each
time bash draws the prompt.

### Affected area

`src/vir…

zsh users activate an environment with the bash `activate` script, which puts the environment name into `PS1`. Since
21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when `BASH_VERSION` is set, so
zsh gets the raw value. With the `PROMPT_SUBST` op…

`FishActivator` defines no `quote()`, so it inherits `ViaTemplateActivator.quote`, which returns `shlex.quote(string)`. That function follows POSIX `sh` rules, where a backslash inside single quotes stays a literal character. fish reads `\'` inside single quotes as an escaped quote and `…

`ViaTemplateActivator.instantiate_template` replaces the placeholders in an activation template one key at a time, each across the whole text. When a value that it already substituted and quoted contains the name of a later placeholder, the later pass rewrites that name inside the quoted…

bpf: Infer zext_dst based on static register liveness analysis

As reported in the thread [1], the verifier's 32-bit operations zero
extension logic is broken. This logic is responsible for correct
semantics of 32-bit operations on…

Messages were matched to a connection by JSON-RPC `id` alon…

Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth_code flow.

### Patches

Version 7.1.0 and higher are patched.

### Workarounds

Ensure you pass in only the auth_c…

undici's `fetch()` crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses (a content-encoding limit), but it created the internal response stream before th…

When `multer` is configured with an asynchronous `fileFilter`, a single request can crash the Node.js process. If a request is aborted (for example when one file is rejected) while another file's async `fileFilter` is still pending, the pending callback later resumes a parsing stream tha…

Decoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as `=?utf-8?B?QUJD?=` repeated tens of thousands of times in a `Subject`, `From`, `To`, a filename or a description, took time quadratic in the number of words. The join check ran a regex over the tex…

API clients can supply arbitrary `mm_processor_kwargs` per request. vLLM
forwards these values through the multimodal rendering and processing pipeline
to Hugging Face and custom image/video processor constructors and calls.
Resource-sensitive values such as image size, patch size, patch…

A single request can crash any application using `body-parser` with default options. When a request carries a `Content-Encoding` (for example `gzip`), `body-parser` pipes it into a decompression stream and, after reading the body, leaves that stream piped with no error listener. A payloa…

An unbounded-buffer vulnerability (CWE-770) in the Twisted words IRC server lets any unauthenticated remote client exhaust server memory. `twisted.words.protocols.irc.IRC.dataReceived` appends every received byte to a per-connection buffer and only removes data at a line feed, with no ma…

An allocation-without-limits vulnerability (CWE-770) in the Twisted conch telnet transport lets any unauthenticated remote peer exhaust server memory over a single connection. When the peer opens a telnet subnegotiation with `IAC SB` and then streams bytes without ever sending the `IAC S…

Two checks on the same WebSocket request URI parse it differently. The authentication exemption for keepalive sessions matches raw substrings, while the quarantine introduced to contain those sessions reads a parsed query parameter. Because Go's `url.Values.Get` returns only the first v…

This advisory has been withdrawn because it is a duplicate of GHSA-h7ww-273w-6cm8. This link is maintained to preserve external references.

## Original Description
Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to …

`create_submodule(name, path, url)` clones a submodule into the repo's own `.git`
directory before it rejects the path. A `path` of ".git/hooks" is accepted by the
pre-clone check, so the submodule is cloned straight into the live hooks directory,
and a file named `post-checkout` in th…

The parser's `max_tokens` limit — the documented defence against oversized GraphQL
documents — did not count comment tokens. A document padded with comments could
therefore pass a `max_tokens` check of any size while still allocating one `Token`
object per comment, all of which stay…

The `OverlappingFieldsCanBeMerged` validation rule can be driven into quadratic — and
in the worst case `O(n²·m²)` — running time by a small, highly compressible query. A
single 364 KB document can occupy one CPU core for over five minutes during
*validation*, before any resolver…

DRF's content negotiation parses each Accept token several times per request and never limits the number of tokens or their total size. Each parse ends up in Django's parse_header_parameters, which takes quadratic time when a quoted parameter value is packed with semicolons. On my machi…

An unauthenticated attacker can defeat Django's `DATA_UPLOAD_MAX_MEMORY_SIZE` limit and force a
worker process to allocate arbitrary memory, by naming a compression codec in the Content-Type
charset parameter. A 108-byte request body produces a 50,331,648-character value inside the view…

For a chain of nested elements that each declare many…

A potential unauthenticated denial-of-service vulnerability exists in the chunked import upload path used by `@apostrophecms/import-export`.

The affected import API routes invoke:

`self.apos.http.bigUploadMiddleware()`

before the actual import handler performs its authentication check…

Root Cause:
The HTTP/2 DATA frame handler compute…

This advisory has been withdrawn because it is a duplicate of GHSA-gx7p-2j49-hfq4. This link is maintained to preserve external references.

## Original Description
vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote cl…

This advisory has been withdrawn because it is a duplicate of GHSA-p92p-rxj5-7p2x. This link is maintained to preserve external references.

## Original Description
vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check …

connection.setInstanceFollowRedirects(false);

The synchronous POST builder later overwrites it:

private boolean followRedirects = true;

public A2AHttpResponse post() throws IOException {
Htt…

—

– **Ecosystem:** Maven
– **Affected package:** `org.a2aproject.sdk:a2a-java-sdk-serv…

A link reference definition whose label or title is never closed is O(n²) in markdown-it 15.0.2 with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, …

No credentials are n…

## Summary

A signed integer overflow vulnerability in `s2.NewDict()` allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding `MaxInt64`. When `Dict.Encode()` is subsequently called, the ove…

This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.

Two paths handed credentials to a redirect target, which is a host chosen by the remote server rather than …

This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.

With documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which builds…

A set of eMudhra intermediate certificates were compromised and are being blocked by browsers and other TLS clients. This Electron update adds the same block to both Chromium networking and Node.js `tls`, `https` and `fetch`. On earlier versions, an attacker holding a certificate issued …

`tls.checkServerIdentity()` normalizes the host fo…

`tls.checkServerIdentity()` did not recognize such hos…

Deleting an authentication token through `TokenProxy` silently deletes nothing. The call raises no
exception and reports success, the database row survives, and the token keeps authenticating. Any
application, admin integration or operational script that revokes credentials by calling `…

`HMACAlgorithm.from_jwk` accepts a symmetric (`kty=oct`) JWK whose `k` value is
the empty string and returns a zero-length key without raising. When a token is
then verified with that key object (a `PyJWK`, or a `PyJWK` resolved by
`PyJWKSet` / `PyJWKClient`), the HMAC verifier computes…

The OpenChoreo API server authorized `PUT …/workflowruns/{runName}` against ownership metadata taken from the request body, while the object it actually mutated was selected by the URL path. Nothing forced the two to agree.

A `WorkflowRun`'s membership in a project and component is ca…

This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.

The Camel remote-file consumers poll a directory on a remote server and buil…

This issue affects Apache Camel: from 4.2.0 before 4.18.5, from 4.19.0 before 4.22.1.

The Camel remote-file consumers poll a directory on a remote server and build the ab…

This issue affects Apache Camel: from 4.18.0 before 4.18.5, from 4.19.0 before 4.22.1.

The Camel remote-file consumers poll a directory on a remote server and build…

This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.

The Camel remote-file consumers poll a directory on a remote server and build the ab…

In the `gix` crate, `Cache::protect_options()` in `gix/src/config/cache/access.rs` reads the three filesystem path-protection settings (`core.protectHFS`, `core.protectNTFS`, and `gitoxide.core.protectWindows`) with the unfiltered `gix_config::File::boolean()` accessor instead of the tru…

net/mlx5: HWS, Handle destroying table that has a miss table

If a table has a miss table that was created by
'mlx5hws_table_set_default_miss' API function, its miss_tbl
keeps the table that points to it in a list.
If such table is…

This advisory has been withdrawn because it is a duplicate of GHSA-pjjw-68hj-v9mw. This link is maintained to preserve external references.

## Original Description
Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files…

Caller-supplied prompt text can become executable syntax in the xonsh activation script. An attacker must influence the
value passed to virtualenv, and a user must subsequently activate the environment.

## Affected area

Xonsh reads a UTF-8 activation script using a legacy multibyte enc…

Caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the
value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt.

## Affected area

Bash runs with compatibility level 4.2 and draw…

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading relevant parts of a file (like their pages) where the same, but non-existent indirect object is referenced multiple times.

### Patches

This has been fixed in [pypdf==6.21.2](http…

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed cross-reference streams.

### Patches

This has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2).

### Wor…

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires opening a file with large/wrong upper limits in the xref table.

### Patches

This has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2).

### Workarounds
…

Echo's Proxy middleware could retain a handler, copy goroutines and network connections after a WebSocket client disconnected if the upstream kept its connection open. The raw proxy waited for both copy directions to finish without reliably closing the other connection when one direction …

Echo v4's opt-in Decompress middleware exposed a gzip-decoded request stream without limiting its expanded size. A small compressed request could therefore produce a very large decoded body. Handlers that read or bind that body could consume excessive memory or CPU, and repeated or concur…

Echo v4's opt-in BodyDump middleware read complete request bodies into memory and retained complete response bodies without a capture limit. A client able to submit large requests to a route using BodyDump could cause large allocations before the application handler ran. Large responses, …

The bash activator puts the caller-supplied prompt value into `PS1` unescaped whenever `promptvars` is off at activation time, and assumes prompt expansion can never run afterwards. `promptvars` and posix mode are runtime shell state, not a property of the activation moment: re-enabling …

Additionally, error messages and included file contents are rendered without HTML escapi…

An allocation-without-limits vulnerability in the Twisted XML element stream lets any unauthenticated remote peer exhaust server memory over a single stream. When the peer opens a container element and streams child elements without ever closing the container, every element is materialis…

`toml.parse()` is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via many
array-of-tables (`[[name]]`) headers. `addTableArray()` in `lib/compiler.js` rescans two
entire bookkeeping Sets on every `[[name]]` header without pruning unrelated or distinct
entries, so a docum…

`toml.parse()` is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via a single
long dotted key, table header, or inline-table key. A ~100KB crafted document causes a
multi-second synchronous hang; a ~200KB document crashes the Node.js process outright with an
uncatchable …

| Field | Value |
| — | — |
| Package | `@graphql-tools/utils` (npm, `pkg:github/ardatan/graphql-tools`) |
| Repository | https://github.com/ardatan/graphql-tools |
| Component | `mergeIncrementalResult` / `setObjectKeyPath` (`packages/utils/src/mergeIncrementalResult.ts`) |
…

The 3.4.16 fix for GHSA-p98j-92pf-mc4p only covers a hook that removes the node it was called for. If an `IN_PLACE` hook removes a different node, like the current node's parent or a sibling that has not been visited yet, that subtree is never walked or neutralized. Event handlers in it…

nbconvert <= v7.17.1 has an arbitrary file write vulnerability due to a path traversal in ipynb cell output metadata, more specifically on the filename attribute.

Vulnerable converters : `–to markdown`, `–to latex`, `–to rst`, `–to asciidoc`.

In `ExtractOutputPreprocessor`, `extra…

The GitHub Action bundled with Black can read the version from `tool.black.required-version` if `use_pyproject` is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository.

### Details

This is similar to the…

### Details
`Exif.load()` …

### Details
`TarIO.__init__` reads 512-byte tar headers one at a time,…

An attacker who can supply an existing PDF to an application that appends an image with `Image.save(…, format="PDF", append=True)` can provide a malformed `/Pages` tree where …

## Affected versions
All versions up to and including current HEAD (v13.0.0.dev0, commit e7a7ea84)

## Root cause
Image.…

Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process.

## Workarounds

No workaround exists besides upgrading. Applications using Pages Router or not usi…

### Details
The MSP decoder writes ea…

`launch-editor` checked `fs.existsSync(fileName)` before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in `\\..:line:column`. This removes the requirement that the attacker be able to place a file with a malicious …

Crass converts CSS scientific notation number values with unbounded exponentiation before it clamps the result to `Float::MAX`. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, possibly resul…

Browser CDP discovery could accept blocked WebSocket URLs. In affected versions, a lower-trust caller or configured input path could reach network destinations that should have been blocked by OpenClaw policy.

This advisory is scoped to the named feature and configuration. It does not …

This report is accepted as a FastMCP authorization vulnerability. In supported configurations, a server transform can change the metadata used by a component's authorization policy. Direct lookups previously checked the original component but returned the tr…

### Am…

`installBazaarPlugin` (and the equivalent endpoints for widgets/icons/templates/themes) accept
`packageName`, `repoURL`, and `repoHash` as independent request fields with no validation that
they refer to the same package. `packageName` alone determines the install destination;
`repoURL`/…

RFC 5322 comments nest. addressparser ended a comment at the first `)`, including the one that closes a nested comment, and parsed the rest of the outer comment as header text. `Victim (x(y) <evil@evil.com>) <v@victim.com>` names `v@victim.com` with `x(y) <evil@evil.com>` …

addressparser ends an RFC 5322 group at the first `;`, including one inside a quoted display name or a comment. The text after it is parsed again as top level recipients with the quoting flipped, so text that every conformant parser reads as a display name or comment becom…

addressparser ends an angle-addr at the first `>` it sees, including one inside a quoted local part, a comment or a domain literal. The domain is then read off the text in front of that `>`. `<"a@evil.com>"@good.com>` is the mailbox `"a@evil.com>"@good.com` under RFC 5322,…

Multimodal content parts (`image_url`, `video_url`, `input_audio`, …) accept a user-supplied `uuid` field that vLLM uses **verbatim as the item's cache identity** (`mm_hash`). The two frontend/engine processor caches (P0 "sender" cache in the API process, P1 "receiver" cache in the Eng…

Nuxt compared `routeRules` keys against the raw request path, without decoding percent-encoding, while the router decodes parameters when it resolves a route. A request whose path is percent-encoded can therefore resolve to a page while failing to match the route rule meant to protect i…

Astro's JSX and MDX rendering pipeline treated string children of `<script>` and `<style>` elements as trusted HTML. When a dynamic value was passed through a JSX expression, such as `<script>{value}</script>`, an attacker-controlled value containing `</script>` or `</style>` could termi…

When nodemailer DKIM-signs an outbound message, its DKIM message parser unfolds RFC 5322 header continuation lines with a loop that concatenates each continuation line onto the preceding line and then re-tests the anchored regex `/^[ \t]/` against the growing merged line on every iterati…

Package: Pillow 12.3.0
Source: PyPI sdist pillow-12.3.0.tar.gz
SHA-256: 3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce
Sink: src/_imaging.c:2809:15, xsize += dx

### Details
The code in Pillow 12.3.0 is:
“`c
for (xsize = 0; *text; text++) {
…

## Affected versions
All versions up to and including current HEAD (v13.0.0.dev0, commit e7a7ea84)

## Root cause
BmpRle…

In Vitest 5, Vite's `server.fs.deny` is not applied as intended on Vitest's dev servers. Depending on the server, files that Vite refuses to serve by default (such as `.env`, private keys and certificates, `.npmrc`, and `.git`) or Vitest's own API token file (`.vitest-secret-token`) can…

Package: @apostrophecms/import-export, version 3.7.0.

Release tag reviewed: @apostrophecms/import-export@3.7.0, commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce (September 30, 2026).

Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6.

The importer,…

Package: @apostrophecms/import-export, version 3.7.0.

Release tag reviewed: @apostrophecms/import-export@3.7.0, commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce (September 30, 2026).

Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6.

The importer,…

Package: @apostrophecms/import-export, version 3.7.0.

Release tag reviewed: @apostrophecms/import-export@3.7.0, commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce (September 30, 2026).

Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6.

The importer,…

If an MCP server or authorization server redirected a request to another origin, that origin received custom request headers (such as an `X-API-Key` set in `requestInit.headers`) …

This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.

createCorsHandler() set Access-Control-Allow-Credentials: true outside the origin check, so th…

`FlexAssembler`, the custom-container assembler shipped in the `stream-json` package (`src/core/utils/flex-assembler.js`, re-exported at `stream-json/utils/flex-assembler.js` and `stream-json/web/utils/flex-assembler.js`), compiles a string or RegExp path `filter` into a matcher that run…

`fast-uri` percent-decodes the scheme component with the legacy global `unescape()` before validating it, so an input whose decoded scheme is a valid but dangerous token is emitted as a live scheme. RFC 3986 section 3.1 does not allow percent-encoding in a scheme, so no RFC or WHATWG par…

ODF style values are interpolated into `style="…"` attributes without HTML-escaping in odf-kit's ODS to-HTML renderer (`odsToHtml()`). A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute injection — and th…