AIKIDO-2026-10291

TL;DR

Affected versions of this package allow decompression of base64+gzipped elements JSON without a strict size cap, enabling a maliciously crafted payload to inflate into extremely large data in memory or on disk. An attacker could exploit this by submitting a compressed payload that expands to hundreds of megabytes or more, triggering excessive memory allocation, filesystem consumption, or process crashes. It can lead to denial-of-service conditions during document ingestion or processing pipelines that deserialize these compressed element payloads.