CVE-2026-113357

@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive resul...

CVE-2026-113357 @e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker

@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive resul...

CVE-2026-113357

The @e2e-dev/github package version before 0.4.1 is vulnerable to an improper authorization vulnerability (CWE-863) that allows for CI report hijacking . The root cause is located in the findComment and upsertComment functions within post.ts, which fail to verify the comment author. Consequently,...

EUVD-2026-104928

@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive resul...

Malicious code in tailwindcss-keyframe-kit (npm)

tailwindcss-keyframe-kit 3.0.0, 3.0.1, 3.0.2 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by hackson306623 on 2026-09-28. src/generators/motion-base.js:5 require...

Vite dev server - Cross-Site Scripting

Vite's dev server, when used with appType: 'custom' and manually invoking server.transformIndexHtml using the unmodified request URL, is vulnerable to XSS via a crafted URL payload. If the HTML being served includes an inline module script ..., an attacker can inject a script via the URL,...

Vite server.fs.deny Bypass - Local File Inclusion

Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest- script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than...

Vite - Path Traversal

Vite versions prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13 contain a file exposure vulnerability caused by improper handling of request URLs with '' in the dev server running on Node or Bun, letting attackers access arbitrary files, exploit requires the server to be exposed to the network an...

Vite Dev Server - Information Exposure

Vite is a frontend tooling framework for JavaScript. Before versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network using...

Vite Dev Server - Path Traversal in Optimized Deps .map Handling

Vite development server versions prior to 8.0.5, 7.3.2, and 6.4.2 are vulnerable to path traversal through the optimized dependencies sourcemap handler. The dev server's handling of .map requests for optimized dependencies resolves file paths via normalizePathpath.resolveroot, url.slice1 and call...

CVE-2025-30208

🔥 Vite Dev Server Vulnerability Scanner CVE-2025-30208 🚀 Overview This tool scans for CVE-2025-30208, a vulnerability in the Vite Dev Server. It allows security researchers to quickly detect vulnerable instances using multiple payloads. ⚡ Features ✅ Single URL scanning -u URL ✅ Mass scanning from...

PT-2026-118341

@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive resul...

cachet_2.4.0-dev

CVE-2021-39174 Cachet 2.4.0-dev A python3 script for CVE-2021-39174 Cachet 2.4.0-dev Information Disclosure and RCE via Twig Server Side Template Injection. For the RCE the API KEY for the user is needed. Check out the Leave Songs link below which covers how to get the API KEY via SQL Injection...

CVE-2025-30208-PoC

CVE-2025-30208 - Vite Arbitrary File Read PoC This is a Proof-of-Concept PoC script to exploit CVE-2025-30208, allowing arbitrary file reads on Vite development servers. Vulnerability Details Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2,...

CVE-2025-30208

CVE-2025-30208 Using a special raw import query string on a vite dev server, a attacker can read arbitrary files Summary of the CVE Vite dev servers before 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 can bypass the server.fs.deny file access checks for @fs requests. Appending ?raw?? or ?import&raw??...

CLSA-2026-1792424734 TuxCare security update for @react-router/dev (1 CVE)

TuxCare rebuilt @react-router/dev to address 1 CVE. Fixed in 7.5.1-tuxcare.9...

CLSA-2026-1792424733 TuxCare security update for @react-router/dev (1 CVE)

TuxCare rebuilt @react-router/dev to address 1 CVE. Fixed in 7.5.1-tuxcare.8...

CLSA-2026-1792424730 TuxCare security update for @react-router/dev (3 CVEs)

TuxCare rebuilt @react-router/dev to address 3 CVEs. Fixed in 7.5.1-tuxcare.5...

CLSA-2026-1792424731 TuxCare security update for @react-router/dev (1 CVE)

TuxCare rebuilt @react-router/dev to address 1 CVE. Fixed in 7.5.1-tuxcare.6...

CVE-2025-30208-Series

CVE-2025-30208 & CVE-2025-31125 & CVE-2025-31486 1. Vulnerability Overview CVE-2025-30208, CVE-2025-31125 and CVE-2025-31486 are arbitrary file reading vulnerabilities in the Vite development server. These vulnerabilities allow an attacker to bypass access controls through specific URL parameters...