AIKIDO-2026-10176

TL;DR

Affected versions of this package construct system commands by concatenating cmd and user-controlled options into a single string, which may allow command injection when executed through a shell. Because arguments are not safely passed as separate parameters (e.g., via Open3.capture3 with explicit cmd and args), malicious input can manipulate command structure. An attacker could supply crafted option values containing shell metacharacters (e.g., ;, &&, backticks) to execute arbitrary commands on the host system.