AIKIDO-2026-10058

TL;DR

Affected versions of this package are vulnerable to a Regular Expression Injection via a crafted payload beginning with a forward slash (/), where the mechanism that wraps regex-like strings in double quotes fails to escape existing internal quotes. An attacker can exploit this by supplying an input like /foo"; console.log(-1); "/, where the unescaped quote (") after foo breaks out of the generated string literal, allowing arbitrary JavaScript code execution within contexts like eval or inline <script> tags, as the repaired output becomes is valid, executable code.