CVE-2026-17528
Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting (XSS) via the <select> element. An attacker can supply a malicious payload that is rende…
Published: 2026-07-28 · CVSS: 5.3 · CVSS 4.0
Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting (XSS) via the <select> element. An attacker can supply a malicious payload that is rendered directly into the DOM without proper sanitization, causing arbitrary script execution in a victim’s browser when they view or interact with the affected page.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7