AIKIDO-2026-10043

TL;DR

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via JSON-RPC Request ID Reflection due to missing validation on string-based request IDs in the underlying json_rpc_handler dependency; this vulnerability occurs because user-supplied input within the id field is directly reflected in HTTP responses, allowing an attacker to craft malicious requests containing HTML or JavaScript payloads in the ID, which are then executed in a victim's browser if the response is rendered without proper output encoding or Content-Type hardening.