AIKIDO-2026-502401

TL;DR

The shared SDK exposes a template helper that interpolates {{ ... }} placeholders using a regular expression whose capture group relies on a lazy, unbounded quantifier. When the interpolated string contains many unterminated {{ sequences, the pattern forces the engine into polynomial backtracking that stalls the single-threaded event loop and can hang processing. Before the fix the interpolation regex was also caller-configurable, so plugins supplied their own equally unsafe patterns to the same helper. The fix hard-codes a linear-time pattern that excludes braces inside the capture group and removes the configurable regex parameter.