AIKIDO-2026-10021

TL;DR

Affected versions of this package are vulnerable to Remote Code Execution via Insecure Deserialization, where an attacker with write access to the Redis persistence queue could inject malicious JavaScript code into a job's eventData; this code would then be executed on the server during deserialization using the unsafe eval() function when the job was processed, allowing for system compromise, which was fixed in v3.0.0 by replacing eval() with safe JSON.parse().