AIKIDO-2025-10687

TL;DR

Affected versions of this package are vulnerable to Information Disclosure due to unsanitized user input in URL and host parameters being directly set as OpenTelemetry span attributes. An attacker can exploit this by crafting malicious URLs containing special characters or payloads that, when processed by the monitoring system's telemetry backend, could lead to log injection, misinterpretation of telemetry data, or potential security incidents in downstream systems that consume these spans without proper sanitization.