Severity: CRITICAL (remote code execution on customer sites) · Where: src/tracking-script.ts:886; same flaw in generateGA4StyleScript
siteId / apiEndpoint are concatenated into JS string literals without escaping. The full tracker uses JSON.stringify (Analytics.ts:3114) — this variant does not.
Trigger: attacker-controlled siteId (URL path) or ?api= query, e.g. /sites/x/script?api='; alert(1); // → arbitrary JS executes in the context of every tracked site.
Fix: JSON.stringify() the injected siteId/apiEndpoint (mirror the full tracker) in both generateMinimalTrackingScript and generateGA4StyleScript. Top priority.
Source: adversarial parity/bug audit.