IA Squad
SearchPT

@merill/lokka

js · @merill/lokkaCritical

@merill/lokka prior to 2.1.2: Azure token leak via unvalidated path concatenation

Lokka versions before 2.1.2 built Azure Resource Manager request URLs by directly concatenating user-controlled path input, potent

20 Jun 2026 · act now