AIKIDO-2026-10469

TL;DR

Affected versions of this package are vulnerable to SQL injection due to improper handling of inputs passed to search_path for Postgres dialect. The affected logic allows user-controlled values to be treated as column or table identifiers without enforcing strict validation or escaping, causing them to be interpolated directly into generated SQL. An attacker able to influence these identifier parameters can inject crafted SQL fragments that alter query structure, potentially bypassing intended conditions or executing unintended database operations.