AIKIDO-2026-10197

TL;DR

Affected versions of this package are vulnerable to arbitrary code execution through unsafe YAML deserialization. The configuration loader uses yaml.FullLoader to parse YAML files, which may construct arbitrary Python objects when processing untrusted input. An attacker able to supply or modify the YAML configuration could exploit this behavior to execute malicious code during deserialization.