AIKIDO-2026-10231

TL;DR

Affected versions of this package render webhook payload, header, URL, and debounce key templates using Twig without sandbox enforcement, allowing untrusted template input to execute on the server. Because renderString() processes attacker-controlled template content (e.g., from a compromised admin panel or stored configuration), malicious Twig expressions can invoke arbitrary PHP methods or access sensitive objects. An attacker could inject crafted Twig payloads into the webhook template fields to achieve Remote Code Execution (RCE), exfiltrate secrets, or pivot within the hosting environment. The issue was mitigated by enabling TwigSandbox, which isolates template execution and restricts access to dangerous functions and objects.