AIKIDO-2026-10417

TL;DR

Affected versions of this package are vulnerable to Improper Input Validation in the handling of JSONPath filter expressions, where user-controlled input is evaluated without sufficient restrictions. This allows attackers to inject malicious expressions that are executed via eval(), leading to remote code execution. An attacker can exploit this by crafting specially formed JSONPath queries, potentially resulting in arbitrary code execution in the context of the application. The issue is fixed by removing or securing the use of eval() in filter evaluation, preventing execution of untrusted input.