All 303 findings

Nodemailer's address parser appends each address part to one growing string. A Claude-co-authored change in 9.1.0 reads that string's last character before every append, which V8 can turn into a copy of the whole string, so comment-separated addresses parse in quadratic time. Mailparser feeds inbound headers here. Release 10.0.5 caches the last character.

nodemailer/nodemailerTypeScriptResource abuse & availability

When Nodemailer's address parser cannot read an address strictly, it scans the free text. A Claude-co-authored repair in 10.0.6 replaced the slow regular expression with a scanner whose two new probes still searched the rest of the value, so long headers could stall the event loop until 10.0.9 bounded them. Found by source analysis, not timing.

nodemailer/nodemailerTypeScriptResource abuse & availability

Claude-assisted browser gateway used an unanchored pattern to validate Chrome extension origins, so a crafted page could open the debugging WebSocket from any domain.

mervinpraison/praisonaiPythonAuthentication & access control

AI-assisted scope hardening on the user-list route left ordinary sessions exempt from capability checks and relied on an administrator check that the existing service did not perform. The exposure predated that hardening. Other dashboard routes and the separate WebSocket log path also lack required role authorization, but those independent omissions are not attributed to this change. Version 4.5.1 adds an administrator check for user listing only. Dashboard and log-stream exposure remains in the inspected source revision; no complete advisory repair or binary equivalence is established.

lin-snow/ech0GoAuthentication & access control

PraisonAI added an agent-invocation route without enforcing the configured API key. The repair installs shared authentication middleware on the application.

mervinpraison/praisonaiPythonAuthentication & access control

PraisonAI checked literal IP addresses without resolving ordinary hostnames before Spider requests. The repair checks DNS results for blocked addresses and rejects resolution failures.

mervinpraison/praisonaiPythonSSRF & network boundaries

Hardening of the FrameNet corpus reader tightened the checks on the names that are interpolated into XML file paths, but a corpus subdirectory can hold a symlink whose name passes those checks and points outside the corpus root, so the reader returns text from a file outside the corpus.

nltk/nltkPythonPath & link handling

A CLI coding assistant co-authored the commit that added the transaction API, and its single-transaction endpoint fetched any record by primary key without company scoping or a permission check.

roskus/prospero-flow-crmPHPAuthentication & access control

AI-written code exposed a Management API that fail-open authenticated an empty token and passed user input to shell exec, enabling remote OS command injection.

chenhg5/cc-connectGoInjection & unsafe execution

AI-written webhook code treated an empty configured token as authenticated, then passed a caller-supplied command to a shell, enabling unauthenticated remote code execution.

chenhg5/cc-connectGoInjection & unsafe execution

An AI-assisted webhook request/test component adds response readback to an earlier outbound-request primitive. The shipped SQL-backed test path can cross the intended destination boundary when an admitted client can configure and test webhooks.

mlflow/mlflowPythonSSRF & network boundaries

The AI-written code loads the first .so file matching a broad glob pattern without verifying integrity, enabling arbitrary code execution via a malicious module.

jahlives/openssl_encryptPythonOther / insufficient public mechanism detail

AI-written code interpolated a caller-controlled username into a shell command executed via execAsync, allowing command substitution and arbitrary OS command execution as the server user.

ooples/token-optimizer-mcpJavaScriptInjection & unsafe execution

AI-written web server code exposed session log endpoints without authentication, letting unauthenticated users read files via path traversal.

ooples/token-optimizer-mcpJavaScriptPath & link handling

The AI-assisted change that added the MCP server also added a markdown renderer for report text, and its link conversion writes the URL into an href attribute without escaping quotes, so a stored link can run script when a report is opened.

ccyl13/pentestifyPythonInjection & unsafe execution

An AI-assisted dictionary-redaction repair left deeply nested JSON lists behind the recursion cutoff, allowing sensitive-key values to appear unmasked in authorized Variable responses and the UI.

apache/airflowPythonPath & link handling

A CLI coding assistant co-authored the commit that added the in-process TURN relay server, and its UDP receive loop was started fire and forget with the only exception handler outside the loop.

sipsorcery-org/sipsorceryC#Other / insufficient public mechanism detail

A coding assistant co-authored the commit that added follows and notifications to this Python web app, and the four new endpoints that change that state were exposed as plain GET routes, so any page could trigger them for a signed-in user.

misp/cti-transmutePythonAuthentication & access control

With the optional DeepStream stack installed, request-level video settings can activate GPU decoding without startup authorization and omit the normal metadata pixel check.

vllm-project/vllmPythonAuthentication & access control

A coding assistant co-authored the commit that added emoji reactions to the comment system of this Python web app, and the new reaction endpoint never checked whether the caller was allowed to see the comment it changed.

misp/cti-transmutePythonAuthentication & access control