CVE-2024-42515: Glossarizer Cross-site Scripting vulnerability

The vulnerability stems from improper HTML sanitization when converting glossary terms. The Herolab advisory explicitly references line 240 in jquery.glossarize.js where .html() is used to inject content. jQuery's .html() method inherently parses input as HTML, which re-interprets previously escaped characters (like < and >) as actual HTML tags. This creates an XSS vector when attackers supply malicious payloads in glossary terms. The confidence is high because the advisory directly identifies the .html() usage as the root cause, and this aligns with jQuery's documented behavior of executing HTML content passed to .html().