Threats affecting pkg:github/filesharing

Axeloz Filesharing versions before 2.14.3 contain a stored cross-site scripting (XSS) vulnerability. Authenticated users can inject malicious scripts by embedding raw HTML or javascript: Markdown links in bundle descriptions. When recipients view the public bundle preview page, the injected script executes via Alpine x-html, potentially allowing attackers to steal the owner_token from localStorage and perform owner-scoped actions on victim bundles.