AIKIDO-2026-10133

TL;DR

Affected versions of this package allow the in-form menu to be rendered without proper application context validation, enabling it to appear even when overlaid by other components. This could result in unintended UI exposure and interaction outside the intended application boundary. An attacker might exploit this by triggering the in-form menu in an overlaid or foreign application context to confuse users, intercept interactions, or facilitate phishing-like attacks by presenting trusted UI elements in an untrusted overlay.