AIKIDO-2026-10271

TL;DR

Affected versions of this package are vulnerable to a remote code execution (RCE) vulnerability stemming from unsafe processing of serialized condition configuration data, which could allow untrusted input to be interpreted in a way that executes arbitrary server-side code. This unsafe handling creates a critical risk where specially crafted requests targeting the element indexes/conditions controller may be leveraged to inject executable configuration, potentially leading to full compromise of the affected Craft CMS application. The issue is fixed by cleansing and validating condition config data before use, removing dangerous configuration keys and ensuring arbitrary code execution vectors are mitigated.