Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
next package can be made to run malicious code
published 1 month ago
Summary
The next library, including the version used in GitHub Actions and the rootio/@rootio/next wrapper, can be tricked into executing unwanted code. This could let an attacker run commands on your server or build environment. Update to the latest patched version of next as soon as possible to close the risk.
What to do
- Update next to version 13.5.11-aikido.3.
- Update GitHub Actions next to version 13.5.11-aikido.3.
- Update rootio @rootio/next to version 13.5.11-root.io.3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Root:npm | – | next |
< 13.5.11-aikido.3 Fix: upgrade to 13.5.11-aikido.3
|
| Root:npm | GitHub Actions | next |
< 13.5.11-aikido.3 Fix: upgrade to 13.5.11-aikido.3
|
| Root:npm | rootio | @rootio/next |
< 13.5.11-root.io.3 Fix: upgrade to 13.5.11-root.io.3
|
Original advisory text
AIKIDO-2026-10757 in next - Patched by Root
Root has patched AIKIDO-2026-10757 in the next package for Root:npm. Multiple fixed versions available.
Timeline
Published22 Sep 2026
Updated22 Sep 2026
First seen17 Aug 2026
Sources
Track software like this
Free during beta