Lucene search
+L

1 matches found

Github Security Blog
Github Security Blog
added 2026/09/02 2:46 p.m.27 views

qs array-limit bypass via bracket-key comma parsing

Summary qs v6.15.3 allows bracket-key input to bypass arrayLimit and throwOnLimitExceeded when comma: true. The input a=1,2,3,4 succeeds with arrayLimit: 3, while the equivalent plain-key input is rejected. Affected version tested: text qs v6.15.3 commit 18d085e919dae70c8f1b200ab99323058edab2c2...

6.3CVSS5.8AI score0.0054EPSS
SaveExploits0References5Affected Software1
Rows per page
Query Builder