Threats affecting pkg:github/Akaunting

Akaunting version 3.3.0 contains a stored cross-site scripting (XSS) vulnerability in its XLSX item-import workflow. An authenticated Manager can import an item with a name containing malicious HTML markup. When another authenticated user selects this item while creating a document, the stored name is rendered using Vue's v-html directive, leading to execution of attacker-controlled code within the victim's Akaunting session.