AIKIDO-2026-10143

TL;DR

Affected versions of this package allow insecure URL rewrite handling where url_key validation was overly permissive and SQL queries were built via string interpolation, enabling malicious input to influence database operations. An attacker could craft specially formatted url_key values (including unexpected characters or long strings) to manipulate request_path replacements and, in the worst case, perform SQL injection during update or delete flows. By injecting controlled values into currentPath.request_path or path, an attacker could corrupt URL mappings, overwrite routes of other entities, or disrupt application routing integrity. The fix enforces strict URL key constraints and uses parameterized queries to eliminate injection vectors.