Name of the Vulnerable Software and Affected Versions nextcloud-vue-collections versions prior to 0.4.2

Description The issue concerns an insecure configuration in the v-tooltip component, which allows arbitrary JavaScript to be injected into the tooltip of a collection item. This enables attackers to execute arbitrary code in a victim's browser, leveraging a Cross-Site Scripting (XSS) attack.

Recommendations Upgrade to version 0.4.2 or later.