AIKIDO-2026-10178

TL;DR

Affected versions of this package lack sufficient validation and sanitization when handling file paths, repository inputs, and remote fetch operations, allowing improper path handling, weak hostname validation, and unsafe API parameter usage. An attacker could exploit these weaknesses by supplying crafted repository URLs, malicious output paths, or manipulated file references to trigger path traversal, overwrite arbitrary files, bypass trusted domain checks, or force the system to fetch malicious or oversized files, potentially leading to unauthorized file access, data tampering, or denial of service.