AIKIDO-2025-10467

TL;DR

Affected versions of this package are vulnerable to XSS via unescaped session variables due to improper output sanitization of HTML-injectable session parameters error and message, where the code directly injects session content without escaping. An attacker can exploit this vulnerability by crafting malicious payloads into these session variables, typically by manipulating error-triggering operations, such as failed logins, which are then rendered and executed in victims' browsers when they view the error page, enabling session hijacking or credential theft.