AIKIDO-2025-10966

TL;DR

Affected versions of this package are vulnerable to unsafe deserialization because the __unserialize() method processes untrusted serialized data without sufficient validation or filtering. This allows unexpected or malicious fields to be injected during object reconstruction, potentially leading to unintended application behavior or security impact depending on how the object is later used. The issue is addressed in the patched version by enforcing a strict allowlist, ensuring that only known and expected fields are deserialized.