AIKIDO-2026-10292

TL;DR

Affected versions of this package allow client-side bypass of the trusted-replace-xhr-response and prevent-xhr scriptlets by simply setting xhr.shouldBePrevented = false, effectively disabling enforced XHR interception and response replacement. Because the protection flag is exposed as a predictable, mutable property on the XMLHttpRequest instance, any script running in the page context can override it and neutralize the rule. An attacker controlling injected JavaScript (e.g., malicious third-party script or compromised dependency) could deliberately unset this flag to restore original responses, bypass filtering logic, and access or exfiltrate sensitive data that should have been sanitized or blocked.