Advisories for Composer/Starcitizentools/Tabber-Neue package

Arbitrary HTML can be inserted into the DOM by inserting a payload into any allowed attribute of the <tabber> tag.

There are several sources of arbitrary, unescaped user input being used to construct HTML, which allows any user that can edit pages or otherwise render wikitext to XSS other users. Edit: Only the first XSS can be reproduced in production.