AIKIDO-2026-10358

TL;DR

Affected versions of this package used path handling based on filepath.Walk(dir, ...), which could allow file operations to escape the intended customization directory if untrusted paths, symlinks, or traversal primitives were present. An attacker able to influence repository contents or filesystem layout might exploit this to make the process read, modify, or overwrite files outside the target directory, potentially impacting sensitive files on the host.