Page 13
A high-severity vulnerability in `quinn-proto` 0.11.14 allowed remote attackers to exhaust server memory by sending carefully crafted out-of-order QUIC stream data, with no authentication required. The fix — upgrading to `quinn-proto` 0.11.15 — introduces bounds on the stream reassembly buffer, preventing unbounded memory growth. Applications built with Tauri or any Rust project depending on Quinn should apply this patch immediately.
Four Express.js API endpoints in `index.js` — `/api/config`, `/api/subscriptions`, `/api/sites`, and `/api/refresh` — were fully accessible without any authentication, allowing any remote attacker to retrieve sensitive application data. The fix introduces both an API key authentication middleware and CSRF token protection, ensuring only authorized clients can interact with these endpoints. This is a common but critical oversight in Node.js web services that can expose configuration secrets and s
A high-severity denial-of-service vulnerability (CVE-2026-67214) was discovered in the popular nanoid package, where passing a specially crafted custom alphabet could trigger an infinite loop, hanging the Node.js process indefinitely. The fix upgrades nanoid from version 3.3.11 to 3.3.17 in `web/package-lock.json` and pins the version via a `package.json` override to prevent transitive dependency drift. Because nanoid is widely used for generating unique IDs across frontend and backend JavaScrip
A path traversal vulnerability in `scripts/diff-docx.js` allowed attackers to supply crafted `--output` arguments containing `../` sequences, enabling arbitrary file writes outside the intended working directory. The fix uses `path.resolve()` combined with a working-directory boundary check to ensure all output paths stay within safe bounds. This matters because the script is part of a Node.js library, meaning every downstream consumer was exposed to the same risk.
A critical open redirect vulnerability was discovered in `weex/src/index.we` where the `onclick()` handler passed raw user input directly to `navigator.push()` without any URL validation. An attacker could supply a `javascript:` URI or a phishing URL, causing the app to navigate to arbitrary destinations. The fix adds a strict `https?://` protocol check before any navigation occurs.
A path traversal vulnerability in PostCSS versions before 8.5.18 allowed malicious `sourceMappingURL` comments in CSS files to trick PostCSS into loading arbitrary `.map` files from the filesystem. The fix upgrades PostCSS from 8.5.15 to 8.5.18 in `frontend/package-lock.json` and pins the version via an override in `frontend/package.json`, closing the file disclosure vector before it could be chained with other weaknesses.
CVE-2026-28292 is a critical Remote Code Execution vulnerability in the simple-git npm package that allowed attackers to bypass previously shipped security patches. The flaw affected applications using simple-git versions prior to 3.32.3, and was resolved by upgrading to 3.36.0, which introduced a dedicated argument-parsing architecture to properly sanitize untrusted input before it reaches the underlying git process.
A pnpm workspace configuration was missing two critical security hardening settings — `trustPolicy` and `minimumReleaseAge` — leaving the project vulnerable to malicious package updates and newly published, potentially compromised package versions. The fix adds `trustPolicy: no-downgrade`, `minimumReleaseAge: 10080`, and `blockExoticSubdeps: true` to `pnpm-workspace.yaml`, raising the security bar against supply chain attacks. These settings, available since pnpm v10.16.0 and v10.21.0 respective
A high-severity vulnerability in `quinn-proto` 0.11.14 allowed remote attackers to exhaust server memory by sending deliberately out-of-order QUIC stream data, triggering unbounded buffer growth during reassembly. The fix upgrades `quinn-proto` to 0.11.15, which enforces limits on the reassembly buffer, preventing this denial-of-service attack vector. This patch was applied to the `src/Tauri/src-tauri/Cargo.lock` dependency lockfile in a Tauri desktop application.
A critical hardcoded API key was discovered in `plugins/ocr.js` at line 21, where the OCR integration used a plaintext fallback credential `'K81241004488957'` whenever the `OCR_API_KEY` environment variable was absent. This exposed a live API key to anyone with repository access, enabling unauthorized use of the OCR service. The fix removes the hardcoded fallback entirely and fails fast with a clear error message when the required environment variable is not configured.
A GitHub Actions workflow in `action.yml` was found to pipe the output of `curl` or `wget` directly into a shell interpreter — the classic "curl | bash" install pattern. If the remote server hosting the script is compromised or the URL is hijacked via DNS or CDN attack, an attacker gains arbitrary code execution inside the CI runner with full access to secrets and build artifacts. The fix replaces the unsafe inline execution pattern with a download-verify-then-execute approach.
A high-severity denial-of-service vulnerability in js-yaml 5.2.1 (GHSA-pm4m-ph32-ghv5) allowed attackers to trigger exponential parsing time by crafting malicious YAML flow collections, potentially freezing any Node.js application that processes untrusted YAML input. The fix, upgrading js-yaml from 5.2.1 to 5.2.2, tightens the parser's handling of flow collections so that malformed or adversarial inputs no longer cause runaway CPU consumption. This patch was applied to both `package.json` and `p