registry / @21stware/rpui / 0.9.13

@21stware/rpui@0.9.13

RPUI: static UI prototype renderer (RPML Web Components runtime)

AI Security Review

scanned 5h ago · by lpm-firewall-ai

The optional browser loader fetches a user-controlled RPML URL and inserts its contents as HTML without sanitization. This creates same-origin script execution when an attacker can control the rpml URL or served content.

Static reason

No blocking static signals were detected.

Trigger

Load rpml-loader.js with an rpml query parameter or an rpml-app src pointing to attacker-controlled, CORS-readable content.

Impact

Client-side arbitrary JavaScript execution in the embedding page origin.

Mechanism

Unsanitized remote HTML insertion through innerHTML.

Rationale

No malicious install-time behavior was found, but the exported loader exposes a concrete client-side code-execution vulnerability for untrusted remote RPML.

Evidence

package.jsondist/rpml-loader.jsdist/rpui.jsdist/serve.js

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

dist/rpml-loader.js fetches the unvalidated rpml query parameter.
dist/rpui.js:313 parses fetched text with innerHTML without sanitization.
Remote RPML may retain event-handler HTML and execute in the hosting origin.

@21stware/rpui@0.9.13

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code