AIKIDO-2026-475738

TL;DR

Two security plugins validate input with regular expressions and string matching whose view of the data diverges from the executor grammar. The SQL sanitizer can be bypassed with crafted string literals and comments to run privilege changes, table drops, and mass deletions. The resource filter can be bypassed through URL userinfo parsing differences to reach internal network destinations. The fix replaces the string checks with parser-based validation so the plugin and executor agree on the input.