auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escaped
Unescaped entity property enables Javascript injection.
Advisories for Composer/Damienharper/Auditor-Bundle package
2024
Unescaped entity property enables Javascript injection.