Security vulnerabilities and automated fixes for security issues
466 posts found
General security vulnerabilities spanning misconfigurations, information disclosure, insecure defaults, and violations of security best practices. This category covers issues that don't fit neatly into a single attack vector but still represent meaningful risk to application security posture.
Related CWEs
Affected Languages
A high-severity command injection vulnerability was discovered in Vite's `shared.js` file where the `gitExec()` function used `execSync()` with string concatenation, allowing potential shell metacharacter injection. The fix replaces `execSync()` with `spawnSync()` and passes Git arguments as an array instead of a shell string, eliminating the injection vector entirely.
A high-severity Denial of Service vulnerability (CVE-2026-13149) was discovered in the brace-expansion npm package, where maliciously crafted input could trigger exponential-time complexity and crash Node.js applications. The fix upgrades brace-expansion from version 5.0.6 to 5.0.9 using npm overrides to ensure all nested dependencies receive the patched version.
A high-severity Denial of Service vulnerability in the nanoid package (CVE-2026-67213) was discovered in the project's dependency tree, where crafted input could trigger an infinite loop during random ID generation. The fix upgrades nanoid from 3.3.17 to 3.3.18 and adds an npm override to ensure all transitive dependencies use the patched version.
A Dependabot configuration in `.github/dependabot.yml` was missing cooldown periods for both its npm and GitHub Actions package ecosystems, meaning newly published — potentially malicious or unstable — package versions could be proposed for adoption immediately after release. Adding a `cooldown` block with `default-days: 7` to each ecosystem entry creates a 7-day buffer, allowing the security community time to identify and flag compromised packages before they reach your codebase.
A missing `minimumReleaseAge` setting in `pnpm-workspace.yaml` left this Node.js workspace vulnerable to immediately installing newly published — potentially malicious — package versions. The fix adds `minimumReleaseAge: 10080` (7 days in minutes) to enforce a quarantine window before any freshly published package can be installed. This single configuration change significantly reduces the risk of supply chain attacks targeting the package publishing pipeline.
A high-severity misconfiguration in `.github/dependabot.yml` left three `package-ecosystem` entries without a cooldown period, meaning Dependabot could immediately propose updates from newly published—potentially malicious—packages. The fix adds a `cooldown` block with `default-days: 7` to each entry, introducing a mandatory waiting period before any newly released package version is surfaced as an update candidate. For a Node.js library whose vulnerabilities ripple downstream to all consumers,
Public proxy endpoints in `backend/api/proxy.py` had no rate limiting, allowing any attacker to flood the httpx connection pool with unauthenticated requests and amplify denial-of-service attacks against downstream tile and coordinate-conversion services. The fix introduces a per-IP sliding-window rate limiter using environment-configurable thresholds, closing the amplification vector without breaking legitimate usage.
A missing `cooldown` block in `.github/dependabot.yml` meant that Dependabot could immediately propose updates to newly published npm packages — including those that may be malicious, compromised, or unstable. By adding a `cooldown` with `default-days: 7`, the project now waits one week before surfacing new package versions, giving the security community time to detect and flag bad releases before they reach production.
A missing `cooldown` block in `.github/dependabot.yml` meant this Node.js library could automatically receive and propose dependency updates from newly published packages — before the community has had time to detect malicious or unstable releases. Adding a `cooldown` with `default-days: 7` ensures Dependabot waits one week before surfacing new package versions, giving the ecosystem time to vet them. Because this is a library consumed by downstream users, the risk extends beyond the repository i
A high-severity CSRF vulnerability was discovered in `backend/server.js` of an Express.js application — the server had no CSRF middleware protecting state-changing routes. Without CSRF protection, attackers could trick authenticated users into unknowingly submitting forged requests (like transferring funds or changing account details). The fix adds the `csurf` package with cookie-based token validation, closing the attack surface with a few targeted lines of code.
A pnpm workspace configuration had `minimumReleaseAge` set to `0`, meaning newly published npm packages could be installed immediately—before the community has time to detect malicious or compromised releases. By changing this value to `10080` (seven days in minutes), the project now enforces a quarantine window that dramatically reduces exposure to typosquatting, dependency confusion, and post-publish malware injection attacks.
A Dependabot configuration in `.github/dependabot.yml` was missing a `cooldown` block, meaning dependency updates could be proposed immediately after a new package version was published — including potentially malicious or unstable releases. Adding a `cooldown` with `default-days: 7` ensures a 7-day waiting period before Dependabot opens pull requests for newly published versions, giving the security community time to detect and flag compromised packages.