Page 5
A missing `cooldown` block in the Dependabot configuration for a Node.js project left it exposed to potentially malicious or unstable newly published packages. By adding a `cooldown: default-days: 7` setting, the project now waits seven days before proposing updates, giving the security community time to identify and flag compromised packages before they reach your codebase.
The ECP (External Control Protocol) server in `src/server/ecp.js` exposed device control endpoints—like launching apps and sending keypresses—over the local network with zero authentication. Any attacker sharing the same Wi-Fi or LAN could send unauthenticated HTTP requests to take full control of the simulator. The fix introduces local-only binding controls and access restrictions to close this attack surface.
A cross-site scripting (XSS) vulnerability was discovered in `extension/lib/chatgpt.js` where the `chatgpt.alert()` function used `modalMsg.innerText` to set user-controlled content before passing it to `chatgpt.renderHTML()`, allowing injected HTML to be rendered unsanitized. The fix replaces `innerText` with `textContent` and introduces an allowlist of safe HTML tags and attributes inside `renderHTML()`. This prevents attackers from injecting arbitrary HTML or JavaScript through modal message
A path traversal vulnerability in `skills/baoyu-design/agents/import-design-system.mjs` allowed attackers to escape the intended design system directory by supplying absolute paths, bypassing a guard that only checked for `..` prefixes. The fix adds an `isAbsolute()` check alongside the existing relative-path guard, closing the bypass with a single targeted change. This matters because the `dsDir` argument is user-controlled, meaning any caller of the script could redirect file operations to sen
CVE-2022-29078 is a critical server-side template injection (SSTI) vulnerability in EJS versions prior to 3.1.7, where the `outputFunctionName` option is passed directly into generated code without sanitization, allowing attackers to execute arbitrary JavaScript on the server. The fix upgrades the EJS dependency from 2.7.4 to 3.1.7+ (resolved here as 6.0.1), eliminating the unsafe code generation path. Any Node.js application rendering EJS templates with user-influenced options is at risk of ful
Apache Superset's Cypress testing infrastructure depended on `brace-expansion` 5.0.7, a Node.js package vulnerable to denial of service via malformed brace pattern input (CVE-2026-14257). Upgrading to version 5.0.8 in `superset-frontend/cypress-base/package-lock.json` closes the vulnerability. While the affected file is part of the test toolchain, it lives in the production codebase and is flagged by Trivy as likely exploitable.
CVE-2026-13149 is a high-severity Denial of Service vulnerability in the `brace-expansion` npm package caused by exponential-time complexity when processing certain brace patterns. Because `brace-expansion` is a transitive dependency present in many Node.js projects' production dependency trees, an attacker who can influence glob patterns or file path inputs can trigger runaway CPU consumption and crash the service. The fix upgrades the package to patched versions (1.1.16, 2.1.2, or 5.0.7) and p
A critical misconfiguration in `platforms/m365/wrangler.toml` left developers one copy-paste away from committing live API keys directly into git history. The fix adds an explicit warning comment blocking the `[vars]` anti-pattern and adds `.dev.vars` to `.gitignore`, ensuring secrets flow through Cloudflare's encrypted `wrangler secret` mechanism instead of plaintext config. This matters because git history is permanent — a key committed even once can be extracted long after it's "deleted."
CVE-2026-14257 is a high-severity denial-of-service vulnerability in the `brace-expansion` npm package (versions through 5.0.7) that allows an attacker to trigger an out-of-memory process crash by supplying a crafted string with deeply nested or exponentially large brace patterns. The fix upgrades the dependency to version 5.0.8 and pins it via a Yarn resolution to ensure no transitive dependency pulls in the vulnerable version. Left unpatched, this vulnerability could be exploited to take down
CVE-2026-15074 is a high-severity path traversal vulnerability in `@fastify/static` versions prior to 10.1.1 that allowed remote attackers to bypass route guards by manipulating URL paths. The fix upgrades the package from 9.3.0 to 10.1.1, closing the path traversal vector that could expose protected routes and sensitive files. Because this plugin runs in a production web service handling real user requests, the risk of exploitation was assessed as likely.
A critical security vulnerability was discovered in `src/js/init.js` where a Bugsnag API key was hardcoded directly into client-side JavaScript, making it visible to anyone who inspects the page source or JavaScript bundle. The fix replaces the hardcoded string with an environment variable reference (`import.meta.env.VITE_BUGSNAG_API_KEY`), ensuring the key is injected at build time rather than baked into the shipped code. This pattern is one of the most common — and most avoidable — secrets exp
A critical SQL injection vulnerability was discovered in `lib/ParamediciOSPermissions.js`, where the `service` and `app` variables were interpolated directly into raw SQL strings passed to the `sqlite3` command-line tool without any escaping or parameterization. An attacker with control over these inputs could manipulate the iOS simulator's TCC permission database, potentially granting unauthorized app permissions. The fix applies SQLite-standard single-quote escaping to both variables before th