CVE-2026-23644

esm.sh (a no-build CDN) has a path traversal vulnerability in the extractPackageTarball code path. The issue stems from using path.Clean, which normalizes paths but does not prevent absolute paths inside malicious tar files, allowing potential file writes. The vulnerability existed prior to the G...

Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events

Mattermost does not strip embeds from metadata when broadcasting posted events. This allows users to include arbitrary embeds in posts, which are then broadcasted via websockets. This can be exploited in many ways, for example to create permalinks with fully customizable content or to trigger a...