AIKIDO-2026-10238

TL;DR

Affected versions of this package did not properly validate path parameters (e.g., block_id, page_id, database_id) against path traversal sequences such as .. and URL-encoded variants like %2e%2e, allowing crafted inputs to manipulate the constructed API endpoint. Without strict normalization and validation, an attacker could supply traversal payloads (including double-encoded forms) to alter the resolved request path, potentially accessing unintended resources or bypassing client-side routing constraints. By embedding traversal sequences into path parameters, a malicious user could force the SDK to target different API routes than intended, undermining endpoint integrity and enabling unauthorized data access depending on server-side enforcement.