Security vulnerabilities and automated fixes for wasm issues
2 posts found
A critical security vulnerability in `wasm/kap/standard-lib/fhelp-impl.kap` exposed hardcoded Gemini API keys directly in source code distributed to end users via WASM modules. The fix replaces the embedded credential with secure environment variable retrieval, preventing credential extraction through browser developer tools or binary inspection.
A high-severity heap buffer overflow vulnerability was discovered and patched in the kiss_fft audio processing library, where integer overflow in allocation size calculations could allow attackers to trigger memory corruption via crafted audio file metadata. The fix adds bounds checking before memory allocation, preventing adversarial `nfft` values from causing undersized heap allocations followed by catastrophic buffer overflows. This class of vulnerability is a reminder that untrusted input mu