application-security

A security-focused analysis of how AI agents, tool integrations, prompts, memory, and delegated permissions can create new attack paths across modern applications.

Path traversal in mistune's Include directive allows reading arbitrary files outside the intended markdown directory. Affects all versions up to 3.1.4, fixed in 3.3.0.

An Electron application's IPC handler accepted attacker-controlled destination URLs from the renderer process, enabling full credential and system data exfiltration to arbitrary external endpoints via a single IPC message.