Page 14
A critical open redirect vulnerability was discovered in `weex/src/index.we` where the `onclick()` handler passed raw user input directly to `navigator.push()` without any URL validation. An attacker could supply a `javascript:` URI or a phishing URL, causing the app to navigate to arbitrary destinations. The fix adds a strict `https?://` protocol check before any navigation occurs.
A path traversal vulnerability in PostCSS versions before 8.5.18 allowed malicious `sourceMappingURL` comments in CSS files to trick PostCSS into loading arbitrary `.map` files from the filesystem. The fix upgrades PostCSS from 8.5.15 to 8.5.18 in `frontend/package-lock.json` and pins the version via an override in `frontend/package.json`, closing the file disclosure vector before it could be chained with other weaknesses.
CVE-2026-28292 is a critical Remote Code Execution vulnerability in the simple-git npm package that allowed attackers to bypass previously shipped security patches. The flaw affected applications using simple-git versions prior to 3.32.3, and was resolved by upgrading to 3.36.0, which introduced a dedicated argument-parsing architecture to properly sanitize untrusted input before it reaches the underlying git process.
A pnpm workspace configuration was missing two critical security hardening settings — `trustPolicy` and `minimumReleaseAge` — leaving the project vulnerable to malicious package updates and newly published, potentially compromised package versions. The fix adds `trustPolicy: no-downgrade`, `minimumReleaseAge: 10080`, and `blockExoticSubdeps: true` to `pnpm-workspace.yaml`, raising the security bar against supply chain attacks. These settings, available since pnpm v10.16.0 and v10.21.0 respective
A high-severity vulnerability in `quinn-proto` 0.11.14 allowed remote attackers to exhaust server memory by sending deliberately out-of-order QUIC stream data, triggering unbounded buffer growth during reassembly. The fix upgrades `quinn-proto` to 0.11.15, which enforces limits on the reassembly buffer, preventing this denial-of-service attack vector. This patch was applied to the `src/Tauri/src-tauri/Cargo.lock` dependency lockfile in a Tauri desktop application.
A critical hardcoded API key was discovered in `plugins/ocr.js` at line 21, where the OCR integration used a plaintext fallback credential `'K81241004488957'` whenever the `OCR_API_KEY` environment variable was absent. This exposed a live API key to anyone with repository access, enabling unauthorized use of the OCR service. The fix removes the hardcoded fallback entirely and fails fast with a clear error message when the required environment variable is not configured.
A GitHub Actions workflow in `action.yml` was found to pipe the output of `curl` or `wget` directly into a shell interpreter — the classic "curl | bash" install pattern. If the remote server hosting the script is compromised or the URL is hijacked via DNS or CDN attack, an attacker gains arbitrary code execution inside the CI runner with full access to secrets and build artifacts. The fix replaces the unsafe inline execution pattern with a download-verify-then-execute approach.
A high-severity denial-of-service vulnerability in js-yaml 5.2.1 (GHSA-pm4m-ph32-ghv5) allowed attackers to trigger exponential parsing time by crafting malicious YAML flow collections, potentially freezing any Node.js application that processes untrusted YAML input. The fix, upgrading js-yaml from 5.2.1 to 5.2.2, tightens the parser's handling of flow collections so that malformed or adversarial inputs no longer cause runaway CPU consumption. This patch was applied to both `package.json` and `p
A path traversal vulnerability in `tools/shot.mjs` allowed attackers to supply a malicious file path as a CLI argument, causing Playwright's `screenshot()` method to write files to arbitrary filesystem locations — including sensitive system directories. The fix introduces a new `safepath.mjs` module that resolves and validates every output path against the project root before any file is written.
A critical vulnerability in `script.js` was making unauthenticated HTTPS POST requests to an external summarization service without proper CORS controls or credential isolation, leaving users on compromised networks exposed to man-in-the-middle attacks. The fix adds explicit `mode: 'cors'` and `credentials: 'omit'` to the fetch call, ensuring the browser enforces cross-origin restrictions and prevents unintended credential leakage. This is especially significant because the affected code is part
CVE-2026-44705 is a high-severity path traversal vulnerability in the Node.js `tmp` package where unsanitized `prefix` and `postfix` options allow attackers to escape the intended temporary directory. Three separate nested copies of `tmp` — versions `0.0.28` and `0.2.7` pinned under `can-symlink`, `broccoli`, and `ember-template-recast` — were removed from `package-lock.json` and replaced by a single patched `0.2.6` resolution. The fix eliminates the directory-escape attack surface while leaving
A high-severity command injection vulnerability was discovered in `tools/js/extractPcEntityMetadata.js`, where a `version` parameter was interpolated directly into a shell command string passed to `cp.execSync()`. By replacing the shell-invoking `execSync` with `execFileSync` and passing arguments as an array, the fix eliminates the shell entirely, making it impossible for a malicious `version` value to inject arbitrary commands.