XSS when add class name to Selector Manager

Also running into this XSS bug. For example adding "><img src=x onerror=alert('XSS')> to the classes of a component will cause it to pop up as well.

Thanks a lot!

Thanks for reporting this, @zgeist.

Security and dependency issues are important. The GrapesJS team actively works on keeping dependencies up-to-date.

For you right now:

1. Run npm audit fix to see available patches
2. Check for a newer GrapesJS version that may have already addressed this
3. If available, test the latest stable release before upgrading
4. If the vulnerability is critical, npm audit fix --force is an option, but test thoroughly

Understanding the risk:

• Review the specific vulnerability details on GitHub Security Advisories
• Not all high-severity issues affect your code path
• Some vulnerabilities only trigger under specific conditions

Staying current:

• Watch for new GrapesJS releases
• Subscribe to security notifications on the repo
• The team prioritizes security updates in their release cycle