AIKIDO-2026-10472

TL;DR

Affected versions of this package are vulnerable to command injection in example code that opens URLs using system shell execution. The affected logic constructs a shell command using a user-influenced URL and executes it without proper sanitization or argument separation, allowing crafted input containing shell metacharacters to modify the executed command. An attacker able to control the URL value can inject arbitrary commands, leading to unintended command execution in environments where the example code is reused or adapted in real applications.