AIKIDO-2026-10134

TL;DR

Affected versions of this package are vulnerable to Cross-Site Scripting (XSS) due to improper handling of dynamic params in the example code snippets, where values obtained from HTTP headers and request metadata are embedded into application-generated URLs and markup without sufficient context-aware encoding. Because these values can influence attributes, anchors, or other HTML and JavaScript contexts, an attacker may craft a malicious request that injects an executable script into the rendered page, leading to arbitrary script execution in the victim’s browser, session compromise, data exfiltration, or unauthorized actions within the application context.