AIKIDO-2025-10947

TL;DR

Affected versions of this package are vulnerable to JSON Log Injection via a Missing Character Escape in the logger middleware, where user-supplied input in HTTP requests is not properly escaped before being written to JSON-formatted logs. An attacker can exploit this by crafting malicious query parameters containing JSON special characters, such as commas and quotes, to inject arbitrary fields into the log output, falsifying log data by overwriting critical fields like method and remote_ip or by deliberately corrupting the JSON structure to disrupt log processing systems.