#AppSec

Path traversal in mistune's Include directive allows reading arbitrary files outside the intended markdown directory. Affects all versions up to 3.1.4, fixed in 3.3.0.

Persistent Denial of Service in Kirby CMS via malformed image upload. An authenticated Editor can crash the application into an unrecoverable state by exploiting unchecked getimagesize() return values.

Unsafe EDITOR environment variable parsing in uniget CLI v0.27.3 via strings.Split() allows unintended argument injection and command execution.

Path traversal vulnerability in uniget CLI v0.27.3 allows local users to access and modify arbitrary files via directory escape sequences in hook filenames.

An Electron application's IPC handler accepted attacker-controlled destination URLs from the renderer process, enabling full credential and system data exfiltration to arbitrary external endpoints via a single IPC message.