Impact

CSS Selector expressions are not properly encoded, which can lead to XSS (cross-site scripting) vulnerabilities.

Patches

This is patched in v1.14.0.

Workarounds

Users can apply encoding manually to their selectors, if they are unable to upgrade.

References

• #691