AIKIDO-2026-10071

TL;DR

Affected versions of this package are vulnerable to Unsafe Reflection via invoke() Validation Bypass, where the invoke() function skips the validation logic intended to restrict access to internal attributes such as __globals__ or __builtins__, allowing for unsafe reflection. An attacker could exploit this by crafting malicious inputs to invoke() to access these internals, potentially leading to information disclosure or remote code execution.