AIKIDO-2026-965854

TL;DR

A type-checking bypass in the URL serialization path allowed an attacker to inject arbitrary code by crafting a spoofed URL object — specifically via Object.create(URL.prototype) — whose toString() method returns a non-string value (e.g., an object or function). The fix validates that URL.toString() yields a primitive string before passing it to serialize(), rejecting anything else with a TypeError. An attacker supplies a malicious object that inherits from URL.prototype and overrides toString() to return a crafted non-string payload; since the old code passed the result of .toString() directly into serialize() without type validation, that payload could survive into the generated new URL(...) expression and execute arbitrary code during deserialization.