AIKIDO-2026-602982

TL;DR

The ida:// KE deep-link handler downloads and opens assets from a location carried in the deep link (a url= query parameter in 0.18.3+, and the ida://<host>/api/v1/buckets/... host/path form in 0.17.0-0.18.2). It fetches that location, writes the result to a filesystem path built from URL-controlled names, and shells out to a native confirmation dialog, all without validating the origin or requiring user consent. Untrusted deep links can reach internal network endpoints, write files outside the downloads directory, inject strings into the dialog to run commands, and auto-open downloaded content with no interaction. The fix (0.18.6) adds host and network validation with DNS-rebinding-resistant IP pinning, path containment checks, dialog hardening, and fail-closed user consent before any download or filesystem side effect.