AIKIDO-2026-10056

TL;DR

Affected versions of the package are vulnerable to regular expression injection due to the use of a user-controlled directory value when dynamically constructing a RegExp without proper escaping. By embedding the raw dirToFlatten value directly into a regular expression, an attacker can inject arbitrary regex fragments and influence matching behavior. Properly escaping all regex metacharacters before building dirToFlattenRegex preserves the intended semantics while preventing regex injection.