AIKIDO-2025-10533

TL;DR

Affected versions of this package are vulnerable to information disclosure due to clear-text logging of sensitive file paths in FSWatcher, where error handling exposed full file paths in plain-text logs due to unsafe logging practices. Specifically, the FSWatcher component logged unreadable file paths during failures, directly revealing sensitive system paths. Attackers compromising log storage or intercepting log streams could exploit this to map critical file locations (e.g., auth.env, config.yaml) and subsequently target these paths for credential theft, configuration tampering, or lateral movement.