Page 41
A critical security vulnerability was discovered in all.html where a Yandex Maps API key was embedded directly in client-side HTML at line 68. This pattern exposed API credentials to anyone viewing the page source, enabling unlimited unauthorized API requests. The fix removed the API key from the client-side code, demonstrating proper API key management for JavaScript applications.
A critical cross-site scripting (XSS) vulnerability in the sanitize-html library allowed attackers to bypass HTML sanitization through improper handling of the `<xmp>` raw-text element. This vulnerability could enable stored XSS attacks in any Node.js application using sanitize-html versions prior to 2.17.4. The fix involved upgrading the library to properly handle raw-text elements and prevent script injection.
A pnpm workspace configuration was missing the `minimumReleaseAge` setting, meaning freshly published — and potentially malicious or unstable — npm packages could be installed immediately. By adding `minimumReleaseAge: 10080` to `pnpm-workspace.yaml`, the project now enforces a seven-day waiting period before any newly released package version can be installed. This single configuration change significantly reduces the attack surface for supply chain attacks targeting this Node.js library and it
A critical security vulnerability was discovered in the `telegrambot/99-telegrambot.html` file where the Telegram bot token was registered as a Node-RED credential of type `'text'` instead of `'password'`. This meant the token was transmitted in plaintext over the admin API and stored without obfuscation in `flows_cred.json`, allowing attackers with filesystem or network access to recover the bot token and take full control of the Telegram bot.
The Frida Android server used PBKDF2WithHmacSHA1And8BIT with only 128 iterations to derive secret keys for device attestation. This critically weak configuration made password brute-forcing trivial, allowing attackers who obtained the derived key to recover the original password in seconds. The fix upgraded to PBKDF2WithHmacSHA256 with 600,000 iterations, meeting modern cryptographic standards.
CVE-2026-59873 is a critical Denial of Service vulnerability in the `node-tar` package (versions before 7.5.19) that allows an attacker to trigger resource exhaustion by supplying a crafted gzip bomb archive. The fix upgrades `tar` from 7.5.16 to 7.5.19 in both `package.json` and `package-lock.json`, closing the attack surface for any Node.js application that processes tar archives. Because this package is used in production code — not just in tests — the exposure was real and immediate.
A high-severity Denial of Service vulnerability (CVE-2026-59892) was discovered in @opentelemetry/propagator-jaeger version 2.7.1, where malformed HTTP headers could crash Node.js applications during trace context decoding. The vulnerability was fixed by upgrading from version 2.7.1 to 2.9.0, which includes improved header validation and error handling to prevent application crashes from malicious or corrupted trace propagation headers.
A critical remote code execution vulnerability in `utils/remote-run.js` allowed attackers to execute arbitrary JavaScript code by passing any malicious URL to the script. The fix implements URL whitelist validation to ensure only trusted sources can be executed, preventing complete system compromise on any machine running the vulnerable code.
A critical buffer overflow vulnerability was discovered in `backend/sgx/enclave/enclave.c` where the `ecall_store_data` function performed `memcpy` operations without proper bounds checking against the actual destination buffer size. An attacker could supply a malicious `data_len` parameter to overflow the enclave's secure storage buffer, potentially corrupting trusted execution environment memory. The fix replaces a hardcoded magic number check with a precise size comparison against the actual
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in Anthropic's Model Context Protocol (MCP) TypeScript SDK version 1.24.0. This high-severity flaw (CVE-2026-0621) could allow attackers to craft malicious input that causes catastrophic regex backtracking, freezing the Node.js event loop. The fix involves upgrading to @modelcontextprotocol/sdk version 1.25.2, which patches the vulnerable regex patterns.
A critical vulnerability in the Telegram OAuth provider allowed attackers to bypass authentication by submitting fabricated hash values without cryptographic validation. The fix replaces an unsafe string comparison with PHP's constant-time `hash_equals()` function, preventing timing attacks and ensuring all user data parameters are properly validated against the HMAC-SHA256 signature.
A high-severity security finding was identified in `templates/claude-workflow/workflows/claude.yml` where `secrets: inherit` passed every repository secret to a reusable workflow, violating the principle of least privilege. The fix explicitly passes only `CLAUDE_CODE_OAUTH_TOKEN`—the single secret the called workflow actually needs—drastically reducing the blast radius if the reusable workflow is ever compromised.