Only the latest published version of @vortexlabs/kirari, @vortexlabs/kirari-rehype, and @vortexlabs/kirari-react receives security fixes. The three packages share one version.

Do not open a public issue. Report vulnerabilities privately through GitHub security advisories.

Include:

• the affected package and version
• a description of the issue and its impact
• steps or a minimal input that reproduces it

You will get an acknowledgement within a few days. Once a fix is released, the advisory is published with credit to the reporter unless you prefer otherwise.

Kirari turns untrusted source code into tokens, HTML, and React elements. Issues of particular interest include:

• markup or script injection through highlighted output
• inputs that cause catastrophic backtracking or unbounded work
• unsafe handling of user-supplied languages, themes, or decorations