AIKIDO-2026-721295

TL;DR

The package previously let user-controlled identifiers flow into request URL path construction without sufficient validation, which could enable path traversal or malformed endpoint access. The fix now centrally rejects unsafe path segments such as /, \, %, ., and .., and fails early with a NotFoundError instead of issuing the request. An attacker might exploit this by supplying a crafted identifier containing traversal sequences or encoded path characters to alter the intended request path, potentially reaching unauthorized resources or triggering unintended backend operations.