opencode 安全漏洞

opencode is an AI programming intelligence open-sourced by Anomaly. A security vulnerability exists in versions prior to opencode 1.1.10, which stems from the Markdown renderer not cleaning up the LLM response, and could lead to the execution of JavaScript via HTML injection...

CVE-2019-20857

An issue was discovered in Mattermost Server before 5.16.0. It allows attackers to cause a denial of service markdown renderer hang via many backtick characters...

CVE-2025-57352 vulnerabilities

Vulnerabilities for packages: grafana-image-renderer, opensearch-dashboards...

GHSA-RX8G-88G5-QH64 vulnerabilities

Vulnerabilities for packages: grafana-image-renderer, opensearch-dashboards...

GHSA-RX8G-88G5-QH64 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, opensearch-dashboards-fips, foxx-cli, grafana-image-renderer...

CVE-2025-57352 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, opensearch-dashboards-fips, foxx-cli, grafana-image-renderer...

PT-2026-26522

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 146.0.7680.153 Description A flaw exists in Google Chrome's Navigation feature due to inadequate validation of untrusted input. This could allow a remote attacker who has already compromised the renderer process...

CVE-2025-14695

A vulnerability was determined in SamuNatsu HaloBot up to 026b01d4a896d93eaaf9d5163a287dc9f267515b. Affected is the function htmlrenderer of the file plugins/htmlrenderer/index.js of the component Inter-plugin API. Executing manipulation of the argument action can lead to dynamically-managed code...

CVE-2025-67744 Mermaid XSS vulnerability leads to Remote Code Execution

DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to version 0.5.3, a security vulnerability exists in the Mermaid diagram rendering component that allows arbitrary JavaScript execution. Due to the exposure of the Electron IPC renderer...

CVE-2025-14695

A vulnerability was determined in SamuNatsu HaloBot up to 026b01d4a896d93eaaf9d5163a287dc9f267515b. Affected is the function htmlrenderer of the file plugins/htmlrenderer/index.js of the component Inter-plugin API. Executing manipulation of the argument action can lead to dynamically-managed code...

CVE-2025-14695 SamuNatsu HaloBot Inter-plugin API index.js html_renderer dynamically-managed code resources

A vulnerability was determined in SamuNatsu HaloBot up to 026b01d4a896d93eaaf9d5163a287dc9f267515b. Affected is the function htmlrenderer of the file plugins/htmlrenderer/index.js of the component Inter-plugin API. Executing manipulation of the argument action can lead to dynamically-managed code...

CVE-2025-14695 SamuNatsu HaloBot Inter-plugin API index.js html_renderer dynamically-managed code resources

A vulnerability was determined in SamuNatsu HaloBot up to 026b01d4a896d93eaaf9d5163a287dc9f267515b. Affected is the function htmlrenderer of the file plugins/htmlrenderer/index.js of the component Inter-plugin API. Executing manipulation of the argument action can lead to dynamically-managed code...

EUVD-2025-203319

A vulnerability was determined in SamuNatsu HaloBot up to 026b01d4a896d93eaaf9d5163a287dc9f267515b. Affected is the function htmlrenderer of the file plugins/htmlrenderer/index.js of the component Inter-plugin API. Executing manipulation of the argument action can lead to dynamically-managed code...

PT-2025-51183

A vulnerability was determined in SamuNatsu HaloBot up to 026b01d4a896d93eaaf9d5163a287dc9f267515b. Affected is the function html renderer of the file plugins/html renderer/index.js of the component Inter-plugin API. Executing manipulation of the argument action can lead to dynamically-managed co...

HaloBot 安全漏洞

HaloBot is a robotics framework by the individual developers at SNRainiar. A security vulnerability exists in HaloBot, which stems from the incorrect manipulation of the parameter action in the file plugins/htmlrenderer/index.js, which could lead to dynamically managed code resources...

CVE-2025-66481 DeepChat's Incomplete XSS Fix Allows RCE through Mermaid Content

DeepChat is an open-source AI chat platform that supports cloud models and LLMs. Versions 0.5.1 and below are vulnerable to XSS attacks through improperly sanitized Mermaid content. The recent security patch for MermaidArtifact.vue is insufficient and can be bypassed using unquoted HTML attribute...

EUVD-2025-201843

DeepChat is an open-source AI chat platform that supports cloud models and LLMs. Versions 0.5.1 and below are vulnerable to XSS attacks through improperly sanitized Mermaid content. The recent security patch for MermaidArtifact.vue is insufficient and can be bypassed using unquoted HTML attribute...

PT-2025-49683

Name of the Vulnerable Software and Affected Versions DeepChat versions 0.5.1 and below Description DeepChat, an open-source AI chat platform supporting cloud models and LLMs, is susceptible to Cross-Site Scripting XSS attacks due to inadequate sanitization of Mermaid content. The initial securit...

Google Chrome Error Type Conversion Vulnerability

Google Chrome is a web browser developed by Google Inc. to provide users with a fast, secure and customizable web browsing experience. Google Chrome suffers from a mis-typed conversion vulnerability that originates from the presence of a mis-typed conversion in the loader, which can be exploited ...

CVE-2025-13633

Use after free in Digital Credentials in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...