AIKIDO-2024-10518

TL;DR

Affected versions of this package do not use a hashing function resistant to hash collision attacks. When deserializing data from untrusted sources, this can introduce security vulnerabilities, including arbitrary code execution or denial of service (DoS) attacks. Untrusted data may originate from external networks, be tampered with during transmission over unauthenticated connections, or come from compromised local storage. While MessagePack does not claim to authenticate or make data tamper-resistant, making this a low-severity vulnerability, updating to a more secure algorithm is recommended.