AIKIDO-2026-10232

TL;DR

Affected versions of this package are vulnerable to Improper Input Validation, where insufficient or inconsistent enforcement of input constraints (URL validation via filter_var(), phone number format checks, non-empty message validation, and configuration parameter validation) allows untrusted data to be processed without strict canonicalization and boundary controls. An attacker could exploit this by supplying crafted URLs (e.g., SSRF or open redirect payloads), malformed or empty phone numbers to bypass business logic, injecting unexpected message content for downstream injection vectors (such as XSS or log injection), or manipulating configuration parameters to alter application behavior, potentially leading to data exfiltration, unauthorized actions, or service abuse.