From 9a3c7487c8761eaa8f3b07589d6dcdfa5d1e4ed6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Anne?= <cedric.anne@gmail.com>
Date: Tue, 31 May 2022 10:04:12 +0200
Subject: [PATCH] Merge pull request from GHSA-33g2-m556-gccr

---
 js/modules/Kanban/Kanban.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/js/modules/Kanban/Kanban.js b/js/modules/Kanban/Kanban.js
index 6bebeb5e28e..8cca283414d 100644
--- a/js/modules/Kanban/Kanban.js
+++ b/js/modules/Kanban/Kanban.js
@@ -33,6 +33,7 @@
 
 import SearchInput from "../SearchTokenizer/SearchInput.js";
 
+/* global escapeMarkupText */
 /* global sortable */
 /* global glpi_toast_error */
 
@@ -2447,7 +2448,7 @@ class GLPIKanbanRights {
                     l.append(`
                      <div class="member-details">
                         ${member_item}
-                        ${l.attr('data-name') || `${member_itemtype} (${member_items_id})`}
+                        ${escapeMarkupText(l.attr('data-name')) || `${member_itemtype} (${member_items_id})`}
                      </div>
                      <button type="button" name="delete" class="btn btn-ghost-danger">
                         <i class="ti ti-x" title="${__('Delete')}"></i>