AIKIDO-2025-10724

TL;DR

Affected versions of this package are vulnerable to URL Injection due to improper input sanitization. The vulnerability occurs because user-supplied values from argTitle, argUser, argHashtags, and argImage are directly concatenated into the URL string before encoding occurs. An attacker can exploit this by injecting malicious parameters or altering the URL structure through these unencoded inputs, potentially leading to open redirects, phishing attacks, or other client-side vulnerabilities. The security risk exists because the initial concatenation happens before any encoding, allowing special characters to modify the final URL construction.