AIKIDO-2026-10462

TL;DR

Affected versions of this package are vulnerable to stored XSS via path-based mock server responses. An attacker can create a mock example with a script-capable Content-Type and malicious HTML/JavaScript body. When the response is served through the path-based backend URL (<backend-origin>/mock/<id>/...), it is treated as same-origin with the backend, allowing the injected script to perform authenticated actions using the victim’s backend session.