Page 12
A critical OS command injection vulnerability was discovered in `backend_android.py`, where the `_sendevent` function constructed shell commands using f-string interpolation with a user-controlled `dev` parameter and executed them with `shell=True`. An attacker could exploit this by sending a crafted `android-config` packet with a malicious `eventDev` value containing shell metacharacters, enabling arbitrary command execution on the host. The fix validates the `dev` parameter against a strict re
A critical vulnerability in `server.js` allowed the application to fetch update manifests over unencrypted HTTP connections, opening the door to man-in-the-middle attacks that could serve malicious update payloads. The fix enforces HTTPS-only connections by tightening a single regular expression in the `readUpdateManifest` function. This change closes an attack vector that could have led to remote code execution via a trojanized installer.
CVE-2026-39244 is a high-severity Denial of Service vulnerability in adm-zip versions prior to 0.6.0, where a specially crafted ZIP file can cause the library to allocate excessive amounts of memory, potentially crashing the Node.js process. The fix involves upgrading adm-zip from 0.5.17 to 0.6.0 in the client-side dependency tree, patching the unsafe memory allocation behavior introduced by malicious ZIP metadata. Any application that processes user-supplied ZIP files using adm-zip is directly
A high-severity denial-of-service vulnerability (CVE-2026-13149) in the `brace-expansion` package was fixed by upgrading `concurrently` from `^9.2.1` to `^9.2.4`, which pulls in `shell-quote 1.9.0` instead of the vulnerable `1.8.3`. The flaw allowed an attacker to craft a specially formed brace-expansion pattern that caused exponential processing time, potentially hanging Node.js processes. Left unpatched, any code path that passed user-influenced strings through `concurrently`'s shell-quoting l
A critical vulnerability in Sequelize (CVE-2023-22579) allowed attackers to inject raw SQL through an unsafe fall-through in the `getWhereConditions` function when parentheses were used in query attributes. Upgrading from version 6.26.0 to 6.29.0 closes this attack vector by tightening how raw attributes are handled. Any Node.js application using Sequelize for database queries should treat this upgrade as an urgent security priority.
CVE-2026-32285 is a high-severity Denial of Service vulnerability in the Go library `github.com/buger/jsonparser` v1.1.1, triggered by crafted malformed JSON input. The fix is a dependency upgrade to v1.1.2 in `go.mod` and `go.sum`, which tightens input handling without affecting valid JSON processing. Any Go application that parses untrusted JSON through this library is potentially exposed until the upgrade is applied.
A high-severity path traversal vulnerability (GHSA-r28c-9q8g-f849) in PostCSS versions prior to 8.5.18 allowed attackers to abuse the `sourceMappingURL` comment auto-loading mechanism to read arbitrary `.map` files outside the intended directory. The fix upgrades PostCSS from 8.5.15 to 8.5.18 in `frontend/package-lock.json` and pins the version via an `overrides` block in `frontend/package.json`. This closes a file disclosure primitive that, while not independently exploitable in all configurati
A critical command injection vulnerability (CVE-2026-9277) was discovered in shell-quote 1.8.3, where unescaped line terminators could allow arbitrary code execution by bypassing the library's shell argument quoting logic. The fix upgrades shell-quote to version 1.8.4 and pins the dependency via a package.json override to ensure the patched version is consistently resolved across the dependency tree. This matters because shell-quote is widely used in Node.js tooling to safely construct shell com
CVE-2026-54466 is a critical vulnerability in the `websocket-driver` npm package (versions prior to 0.7.5) that exposes applications to exploitation through malformed WebSocket protocol input. The fix pins the dependency to `0.7.5` via a pnpm override, closing the attack surface in both `faye-websocket` and any other consumers in the dependency tree. Because WebSocket connections are a common real-time communication channel, leaving this unpatched puts any application that handles untrusted WebS
A high-severity command injection vulnerability was discovered in `src/cli/commands/extract.js` at line 257, where user-controlled input was passed unsanitized into a `child_process` call via the `extractZipWithSystemTool` function. The fix eliminates the dangerous shell execution path entirely by removing the `spawn`-based system tool invocation and relying on the safe, pure-JavaScript `yauzl` library for ZIP extraction. This proactive hardening prevents downstream consumers of this Node.js lib
A critical Server-Side Request Forgery (SSRF) vulnerability was discovered in `functions/stream/createProxyResponse.js`, where the `location` parameter was passed directly to `fetch()` without any URL validation. This allowed attackers to weaponize the proxy function to reach internal network resources, cloud metadata endpoints, and arbitrary external services. The fix adds protocol validation using the `URL` constructor before any fetch operation is performed.
A path traversal vulnerability in `scripts/merge_m3u.py` allowed user-influenced file paths returned by `glob.glob()` to escape the intended `custom/` directory boundary, potentially exposing arbitrary files on the system. The fix adds a `os.path.realpath()` check that filters out any resolved path that falls outside the expected directory. This is a proactive hardening measure that removes an exploit primitive before it can be chained with other weaknesses.