Document and mitigate XSS risk from plugin transform innerHTML output

[RA9]

Description

When a plugin transforms a cell value, the result is set directly as innerHTML:

Relevant code

src/index.ts around line 981:

if (pluginTransformed) {
  td.innerHTML = value;  // unsanitized HTML injection
} else {
  td.textContent = value;  // safe
}

If plugin data comes from user-controlled server responses, this is a direct XSS vector.

Recommended fix

• Add a warning in the documentation that plugin transform results are injected as raw HTML.
• Optionally provide a sanitize option (default true) that runs output through DOMPurify or a built-in sanitizer before assignment.