Threats affecting pkg:npm/@hydrooj/ui-default

CVE-2026-126800 is a stored cross-site scripting (XSS) vulnerability in the @hydrooj/ui-default package before version 4.59.1. It allows registered users to inject malicious scripts by placing double quotes in language-class tokens within markdown-it-xss.ts. The injected script can be stored in user profile bios and executes when viewed by administrators or other users, enabling theft of non-httpOnly sid session cookies and potential session hijacking.