Cross-site Scripting Vulnerability in @yaireo/tagify Package about tagify

[yairEO]

there is no vulnerability. closing.

[TechnoRahmon]

hey @yairEO
If you're unable to view the report and wish to avert your gaze, then it's genuinely worth contemplating switching from the Tagify library to another.

[yairEO]

sanitization should never be done in front-end, but only backend APIs.
I have been a believer in this for almost 20 years of designing highly complex web systems for large scale enterprises.

Tagify is only a GUI for editing an completely ordinary <input> element's content.
It's just a design overlay.

You misunderstand how Tagify work if you think it has a scripting vulnerability, because in the end, Tagify is not, and never will be, a complete 100% solution for everything for a developer to drop and forget.

A developer still needs to submit a form or data to a server, same as was done for decades, and this process is unrelated to Tagify. It's in the developer's hands to do whatever they want/need with the above mentioned <input> value, and if they are serious devs, they would already have sanitization in-place for every form and data submission to their backend -> database.