AIKIDO-2026-10101

TL;DR

Affected versions of this package are vulnerable to Remote Expression Execution via the Internal Expression Evaluation Endpoint, where the internal HTTP server's /expr endpoint, which compiles and executes user-supplied Go expressions from the code parameter, can be exploited if the server is inadvertently exposed or if the low-entropy default authentication secret (by-dev) is guessed or leaked, allowing an attacker to execute arbitrary logic within the server's context, such as calling exposed functions like param.Get() or param.Save() to read or manipulate configuration, leading to information disclosure, system compromise, or denial-of-service.