[OskarEichler]

Issue

The documentation playground renders result fields with Vue v-html. Raw JSON values were returned without escaping when match highlighting was disabled or when a displayed field had no match. A pasted payload such as an img element with an onerror handler therefore executed in the Fuse.js documentation origin.

The vulnerable path was introduced by the VitePress playground and is present in releases v7.4.0 through v7.5.0. This affects the public documentation playground, not the Fuse.js runtime package.

Fix

Move result rendering into a small pure helper and escape every user-controlled value before adding the one trusted mark element generated by the playground.

Verification

• Added focused regression coverage for highlighting-disabled, unmatched-field, and highlighted-result paths
• Full suite: 23 files / 452 tests passed
• Lint passed
• Typecheck passed
• Package build passed
• Documentation build passed
• Browser reproduction confirmed the payload is rendered literally and no handler executes
• git diff --check passed

Breaking changes

None.