Description
Affected versions of `jqtree` are vulnerable to cross-site scripting in the drag and drop functionality for modifying tree data.
When a user attempts to drag a node to a different position in the hierarchy, script content existing within the node will be executed.
## Recommendation
Update to 1.3.4 or later.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | jqtree | < 1.3.4 | 1.3.4 | GHSA-gjhx-gxwx-jx9j |