Please do not open a public issue for a security problem.

Report it through GitHub's private advisory form, or by email to inbox@kumardeepak.com.

Expect an acknowledgement within a few days. Since this is a client-side UI component with no network access and no credential handling, the realistic surface is limited to DOM injection through attribute values, so please include a reproduction showing the untrusted input path.