AIKIDO-2026-10503

TL;DR

Affected versions of this package are vulnerable to remote code execution (RCE) due to improper enforcement of disabled alert handlers in TICKscript processing. The affected logic allows scripts to invoke alert handler methods such as .exec(), .log(), or .tcp() directly even when corresponding handlers are configured as disabled via command-line restrictions. An attacker able to create or modify TICKscripts can bypass administrative security controls and execute unauthorized commands or trigger unintended outbound actions on the host system.