AIKIDO-2025-10493

TL;DR

Affected versions of the package are vulnerable to SQL injection due to improper handling of negative numbers in the format function. When processing negative values, the vulnerable versions fail to prepend a space before the minus sign. As a result, the minus sign may be interpreted as part of a SQL comment sequence (e.g., --), potentially altering the structure or logic of the underlying SQL query. This flaw enables attackers to inject malicious SQL code, which can lead to unauthorized data access, data manipulation, or other unintended behavior within the database.