Threats affecting pkg:github/mbin

Mbin versions from 1.2.1 up to but not including 1.11.1 contain a stored cross-site scripting (XSS) vulnerability in the EmbedElement::buildDestructed() function. This flaw allows authenticated users to inject HTML code in the alt text of images nested inside links within various content types such as entries, comments, posts, messages, or bios. The injected script can execute in the browsers of users viewing the affected content. The vulnerability is fixed in version 1.11.1.