HIGHnpmGHSA-p26j-h7wj-r568· CVE-2026-49864wetty vulnerable to DOM XSS via file-download filenameModified: 7/1/2026