7 matches found
CVE-2026-100624
Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request is created, an uploadexpiresat timestamp one hour and a 'pending' status are stored in buildrequests, but the upload proxy loads only appid...
CVE-2026-100624
Capgo.app versions prior to 12.264.5 are vulnerable to an upload expiry bypass in the /build/upload/:jobId TUS proxy endpoint. The root cause is that the upload proxy fails to enforce the upload_expires_at timestamp or the pending status from the build_requests table; it only verifies the app.bui...
EUVD-2026-87719
Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request is created, an uploadexpiresat timestamp one hour and a 'pending' status are stored in buildrequests, but the upload proxy loads only appid...
CVE-2026-100624: Insufficient Session Expiration
Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request is created, an uploadexpiresat timestamp one hour and a 'pending' status are stored in buildrequests, but the upload proxy loads only appid...
Unsafe Dependency Resolution
Overview @pnpm/building.policy is a Create a function for filtering out dependencies that are not allowed to be built Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the approval process for dependency sources. An attacker can execute unauthorized code during...
