AIKIDO-2026-10020

TL;DR

Affected versions of this package are vulnerable to Open Redirection, where the router does not properly validate or sanitize URL path segments before processing redirects. An attacker can exploit this by crafting a malformed URL containing injected carriage returns and external domains, such as http://localhost:3000/%0d/evil.com/, which causes the application to redirect users to an arbitrary, attacker-controlled site. This rogue redirect can be used for phishing attacks, malware distribution, or to leverage trust in the application's domain.