Page 6
CVE-2026-14257 is a high-severity denial-of-service vulnerability in the `brace-expansion` npm package (versions through 5.0.7) that allows an attacker to trigger an out-of-memory process crash by supplying a crafted string with deeply nested or exponentially large brace patterns. The fix upgrades the dependency to version 5.0.8 and pins it via a Yarn resolution to ensure no transitive dependency pulls in the vulnerable version. Left unpatched, this vulnerability could be exploited to take down
CVE-2026-15074 is a high-severity path traversal vulnerability in `@fastify/static` versions prior to 10.1.1 that allowed remote attackers to bypass route guards by manipulating URL paths. The fix upgrades the package from 9.3.0 to 10.1.1, closing the path traversal vector that could expose protected routes and sensitive files. Because this plugin runs in a production web service handling real user requests, the risk of exploitation was assessed as likely.
A critical security vulnerability was discovered in `src/js/init.js` where a Bugsnag API key was hardcoded directly into client-side JavaScript, making it visible to anyone who inspects the page source or JavaScript bundle. The fix replaces the hardcoded string with an environment variable reference (`import.meta.env.VITE_BUGSNAG_API_KEY`), ensuring the key is injected at build time rather than baked into the shipped code. This pattern is one of the most common — and most avoidable — secrets exp
A critical SQL injection vulnerability was discovered in `lib/ParamediciOSPermissions.js`, where the `service` and `app` variables were interpolated directly into raw SQL strings passed to the `sqlite3` command-line tool without any escaping or parameterization. An attacker with control over these inputs could manipulate the iOS simulator's TCC permission database, potentially granting unauthorized app permissions. The fix applies SQLite-standard single-quote escaping to both variables before th
A missing `cooldown` block in the `.github/dependabot.yml` configuration for the `octicons_react` package left the project vulnerable to supply chain attacks by automatically proposing updates from newly published — and potentially malicious — packages. Adding a `cooldown: default-days: 7` block ensures Dependabot waits one week before surfacing new package versions, giving the security community time to identify and flag malicious releases. This small configuration change meaningfully reduces t
A critical command injection vulnerability (CWE-78) was discovered in the Linux automation module of the `goose-mcp` crate, where Rust code generated Python scripts that passed user-controlled commands directly to `subprocess.run()` with `shell=True`. An attacker who could influence the `commands` parameter in `execute_system_script()` could inject arbitrary shell commands using metacharacters like `;`, `|`, or backticks. The fix replaces `shell=True` with `shlex.split()` and `shell=False`, and
A high-severity cross-site scripting (XSS) vulnerability was discovered in `extension/lib/popup-response.js`, where the `esc()` HTML-escaping function failed to encode backtick characters. Because backticks are valid JavaScript template literal delimiters and can serve as event handler injection vectors in older browsers, this gap allowed attacker-controlled data to break out of safe HTML encoding and potentially execute arbitrary scripts. The fix adds a single `.replace(/\`/g, "`")` call to
A missing `cooldown` block in `.github/dependabot.yml` meant that newly published npm and GitHub Actions packages could be automatically proposed for adoption the moment they appeared on the registry — with no waiting period to detect malicious or unstable releases. Adding `cooldown: default-days: 7` to both `package-ecosystem` entries ensures Dependabot waits a full week before surfacing updates, giving the security community time to identify supply-chain threats before they reach your codebase
A critical command injection vulnerability (CVE-2026-9277) in shell-quote 1.8.3 allowed attackers to achieve arbitrary code execution by injecting unescaped line terminators into shell-parsed strings. The fix upgrades shell-quote to 1.8.4, which properly escapes these characters before they reach shell interpretation. Because this dependency appeared in production code—not just dev tooling—any user-influenced input flowing through shell-quote was a live attack surface.
A high-severity misconfiguration in `.github/dependabot.yml` left this Node.js library without a cooldown period on dependency updates, meaning Dependabot could immediately propose upgrades to newly published — potentially malicious or unstable — package versions. The fix adds a `cooldown` block with `default-days: 7` to both the `npm` and `github-actions` ecosystems, introducing a mandatory waiting period before any newly released version is surfaced as an update candidate. Because this project
A critical vulnerability in a Node.js Panel Connector API (CVE-2025-7783) left 14 endpoints—including shell command execution, file deletion, and file writing—completely open to unauthenticated access. The comment in the source code even declared "NO AUTH — Full Open Access," making it a textbook example of a missing authentication control. The fix adds a Bearer token middleware guard on all `/api` routes, blocking unauthorized requests before they reach any sensitive handler.
A high-severity path traversal vulnerability in PostCSS versions before 8.5.18 allowed attackers to exploit the `sourceMappingURL` auto-loading mechanism to read arbitrary `.map` files from the filesystem. The fix upgrades PostCSS from 8.5.8 to 8.5.18 and pins the dependency via an npm `overrides` entry, closing the attack surface entirely. Any project using PostCSS as a direct or transitive dependency should apply this upgrade immediately.