AIKIDO-2025-10699

TL;DR

Affected versions of this package are vulnerable to callback replacement attacks via deserialization in the Personalization_Tag class due to the absence of a preventive method. This flaw allows attackers to craft malicious serialized data that replaces legitimate callbacks with arbitrary code. The exploitation occurs when the application processes untrusted serialized input, enabling attackers to hijack callback functions and execute unauthorized actions.