AIKIDO-2025-10421

TL;DR

Affected versions of this package are vulnerable to external control of file name or path through the url parameter in the GetErrorResponse method. An attacker can exploit this by supplying a file:// URI, potentially causing the application to relay NTLM credentials in the context of the current user. However, the maintainers note that the security impact is limited, as the same behavior exists in the underlying .NET WebRequest.Create(url) method that this package wraps, and no additional risk is introduced by the wrapper itself.