Problem

customData.group_name and customData.description are interpolated straight into the option aria-label attribute in renderOptions() without escaping:

groupName = d.customData.group_name !== undefined ? `${d.customData.group_name}, ` : '';
optionDesc = d.customData.description !== undefined ? ` ${d.customData.description},` : '';
ariaLabel = `aria-label="${groupName} ${d.label}, ${optionDesc}"`;

A " in either field breaks out of the attribute and can inject markup / event handlers — and this happens even when enableSecureText is enabled, since customData never went through secureText(). That makes it an XSS bypass for security-conscious consumers.

Fix

Route both customData fields through secureText() (the same escaping used for label/value). secureText() is a no-op when enableSecureText is disabled, so behaviour is unchanged for consumers that intentionally pass raw text.

Verification

New spec cypress/e2e/security-customdata-xss.cy.ts:

• mounts a grouped dropdown with a breakout payload in customData (with enableSecureText: true) and asserts no <img> is injected and the onerror never runs;
• asserts the aria-label stays intact (escaped, not broken out).

Other Validations:

• Ran npm run validate for static code validation:
• npm run build: succeeds; dist/docs rebuilt
• All tests passed (ran npm run test ):