AIKIDO-2026-10442

TL;DR

Affected versions of this package are affected by improper input validation in band math expression parsing, where attacker-controlled expressions containing eval( were not rejected before processing. This could enable malicious expression injection and potentially unsafe code evaluation in downstream execution paths. An attacker might exploit this by supplying a crafted expression that includes eval(...) to trigger unintended code execution or manipulate expression handling in applications that process untrusted input.