fixes #989 - fix XSS

yairEO · Feb 17, 2022 · 198c045 · 198c045
1 parent 93f729c
commit 198c045
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/tagify.js b/src/tagify.js
@@ -101,7 +101,7 @@ Tagify.prototype = {
 
         _s.disabled = input.hasAttribute('disabled')
         _s.readonly = _s.readonly || input.hasAttribute('readonly')
-        _s.placeholder = input.getAttribute('placeholder') || _s.placeholder || ""
+        _s.placeholder = escapeHTML(input.getAttribute('placeholder') || _s.placeholder || "")
         _s.required = input.hasAttribute('required')
 
         for( let name in _s.classNames )