# Hacktron AI full LLM context > Expanded LLM-readable context for Hacktron AI. Start with /llms.txt when a shorter map is enough. Website: https://www.hacktron.ai/ Docs: https://docs.hacktron.ai App: https://app.hacktron.ai ## Company and Product Context - Hacktron is an AI-native security platform for code reviews and penetration tests. It helps teams find and fix exploitable vulnerabilities in their applications to defend against AI-powered threats. - Hacktron brings together top CTF researchers, experienced red teamers, and offensive security researchers. The team uses AI to accelerate security research and eliminate vulnerabilities in widely trusted software before malicious actors exploit them. - Hacktron Review is the pull request and merge request security reviewer. It indexes repositories, builds codebase context, and looks for exploitable vulnerabilities before code is merged. - Hacktron Whitebox is the code-aware pentest product. Whitebox uses source-code context, exploit validation, researcher review, and audit-ready reporting for SOC 2 and ISO 27001 workflows. - Findings are delivered in developer workflows such as GitHub or GitLab inline comments, Slack, and Linear. - Hacktron emphasizes exploitability, proof-of-concept quality, low false positives, and rapid remediation over broad scanner noise. - The platform covers business logic flaws, injection, XSS, SSRF, XXE, prompt injection, memory safety bugs, authentication and authorization issues, infrastructure-as-code exposures, supply-chain risks, and secrets. - Teams can tune the reviewer with triage comments and project-specific rules in .hacktron/rules.md. Fixed findings can be auto-resolved after remediation commits. - Hacktron Automations connect security triggers to actions and optional Slack or email notifications. Teams define which findings qualify by severity, repository or application, branch, and environment. Remediate is the first available action and can automatically verify and remediate every matching finding: it prepares and tests a targeted change for review when an issue is real, and records false-positive or no-change outcomes when code should remain untouched. Every run remains searchable in run history. Each organization receives a one-time allocation of 5000 free credits. - Customer stories include Krisp, which integrated Hacktron Review directly into the code review workflow; Zellify, which found issues that traditional automated security tools missed; Rocket.Chat, where Hacktron found a critical Apple OAuth account takeover (CVE-2026-55666); Novu, which catches cross-file vulnerabilities across a codebase 400+ contributors touch; Mobbin, which brought security triage into the pull request workflow; hackajob, where Hacktron caught a cross-customer authorization gap before merge; and Nopan, which deepened security review of its payments infrastructure without slowing delivery. ## Security coverage - Code security · Review: Secure every change before it ships. Hacktron catches and validates vulnerabilities in pull requests, giving developers the confidence to move fast without drowning in noise. - Product security · Whitebox Pentest: Uncover real security issues in production. Hacktron combines deep source-code context with active testing to uncover how weaknesses across your services could lead to a real breach. - Organization security · Continuous red teaming: Simulate a persistent adversary. ## Pricing - PR Review: Pro Plan from $40 / developer / mo. For small teams securing their development workflow. 50 PRs (unlimited scans per PR) per developer, $1 per additional PR; Auto-triage & autofix to verify findings and prepare tested fixes; Self-improving threat models based on triage feedback; GitHub, GitLab, Bitbucket, and Azure DevOps integrations. Start 14-Day Free Trial. No credit card required. Free for Open Source. Enterprise: Custom pricing. - Whitebox: Basic Application from $100; Mature Application from $2,000; Enterprise: Custom pricing. All pentests receive the same assessment depth and quality. Get an instant quote based on codebase size and number of repositories. - [Continuous red teaming](https://www.hacktron.ai/#pricing): Custom pricing. Simulate a persistent adversary. Ongoing adversarial testing across your attack surface; Validated attack paths with clear guidance for remediation; Custom scope tailored to your organization. [Contact Us](https://www.hacktron.ai/calendar). ## Featured research - [HEIF Heist](https://heif-heist.com/): One image parser to pwn them all. Research from Hacktron. ## In the news - [News and press](https://www.hacktron.ai/news): Press coverage of Hacktron’s research and company news. - [Hackers who broke into OpenAI warn the AI industry has a security problem](https://www.washingtonpost.com/technology/2026/09/20/breach-chatgpt-maker-openai-highlights-risks-ai-getting-hacked/): The Washington Post · 2026-09-20. More powerful AI magnifies cyberattack risks. - [Researchers used Claude to hack OpenAI](https://arstechnica.com/ai/2026/09/researchers-used-claude-to-hack-openai/): Financial Times · via Ars Technica · 2026-09-18. Researchers used Claude to reach an OpenAI employee account and sensitive GitHub data. - [Hackers Used Anthropic’s Claude to Break Into OpenAI](https://www.wsj.com/tech/ai/hackers-used-anthropics-claude-to-break-into-openai-b40ba883): The Wall Street Journal · 2026-09-17. A bug-hunting independent security research team accessed OpenAI’s internal code system, exposing growing risks in automated cyber threats - [Active Exploitation Attempts Target WSO2 API Manager JWT Bypass](https://thehackernews.com/2026/09/active-exploitation-attempts-target.html): The Hacker News · 2026-09-16. Attackers are targeting a critical WSO2 flaw reported by Hacktron that can put administrative accounts at risk. - [Attackers pummel critical WordPress vuln to create all sorts of mischief](https://www.theregister.com/security/2026/07/20/attackers-pummel-critical-wordpress-vuln-to-create-all-sorts-of-mischief/5275265): The Register · 2026-07-20. Plus dozens of PoCs in the public domain - [Two new high severity WordPress vulnerabilities, patch immediately!](https://www.helpnetsecurity.com/2026/07/18/wordpress-vulnerabilities-wp2shell-cve-2026-60137-cve-2026-60137/): Help Net Security · 2026-07-18. The 7.0.2 WordPress security release addresses one critical and one high severity security issue. - [GPT-5.6 Sol Ultra Builds Full Chrome Exploit Chain From Security Patches](https://cybersecuritynews.com/gpt-5-6-sol-chrome-exploit-chain/): Cyber Security News · 2026-07-15. In Hacktron’s comparison of three AI models, only Sol Ultra completed the Chrome challenge, costing about $1,597. - [Major GNU software repository Savannah fixes two-year flaw](https://cybernews.com/security/gnu-savannah-patches-two-year-security-flaw/): Cybernews · 2026-06. GNU Savannah, a major platform for developing and distributing free software, said it had patched exploitable flaws that left it vulnerable for roughly 2 years. - [Hacktron Plans to Build AI Platform to Test Code for Vulnerabilities](https://devops.com/hacktron-plans-to-build-ai-platform-to-test-code-for-vulnerabilities/): DevOps.com · 2026-05-13. After raising $2.9 million, Hacktron is building a platform to test code changes and separate exploitable vulnerabilities from false positives. - [Claude Opus wrote a Chrome exploit for $2,283](https://www.theregister.com/security/2026/04/17/claude-opus-wrote-a-chrome-exploit-for-2283/5219906): The Register · 2026-04-17. Pause your Mythos panic because mainstream models anyone can use already pick holes in popular software - [Cloudflare’s Next.js alternative faces critical security flaws](https://cybernews.com/security/hackers-find-critical-flaws-in-cloudflares-nextjs-alternative/): Cybernews · 2026-03. Cloudflare’s AI-built Next.js alternative launched with critical security flaws, intensifying its rivalry with Vercel. - [BeyondTrust fixes critical RCE flaw in remote access tools](https://www.csoonline.com/article/4130415/beyondtrust-fixes-critical-rce-flaw-in-remote-access-tools.html): CSO Online · 2026-02-10. Organizations running BeyondTrust’s self-hosted remote access software are urged to patch a vulnerability rated 9.9 out of 10. - [BeyondTrust warns of critical RCE flaw in remote support software](https://www.bleepingcomputer.com/news/security/beyondtrust-warns-of-critical-rce-flaw-in-remote-support-software/): BleepingComputer · 2026-02-09. BeyondTrust patched its cloud services and urged on-premises customers to update after Hacktron discovered a critical vulnerability. - [BeyondTrust Fixes Critical Pre-Auth RCE Vulnerability in Remote Support and PRA](https://thehackernews.com/2026/02/beyondtrust-fixes-critical-pre-auth-rce.html): The Hacker News · 2026-02-09. A critical vulnerability in BeyondTrust’s remote access products could allow unauthenticated attacks without user interaction. ## Key Public Pages - [Hacktron AI](https://www.hacktron.ai/): AI-Native Cybersecurity Platform. Security for the age of AI-powered threats. - [AI Code Review & SAST for Pull and Merge Requests](https://www.hacktron.ai/pr-review): AI security reviewer for pull and merge requests with codebase context, inline findings in GitHub and GitLab, project-specific learning, automatic resolution, and customer evidence from Krisp, Zellify, Rocket.Chat, Novu, Mobbin, hackajob, and Nopan. - [AI SAST: Exploit-Aware Static Analysis](https://www.hacktron.ai/solutions/ai-sast): AI SAST that reasons about code in context and validates each finding with a proof-of-concept exploit, reducing false positives and catching business-logic flaws. - [Security Workflow Automations](https://www.hacktron.ai/automations): Connect security triggers to actions and notifications. Remediate can automatically verify and remediate every matching finding, prepare a review-ready change for real issues, and record false-positive or no-change decisions. Each organization receives a one-time allocation of 5000 free credits. - [AI White-box Penetration Testing as a Service](https://www.hacktron.ai/pentests): Hacktron Whitebox pentests with code-aware analysis, validated findings, researcher review, a Yoto customer testimonial, and audit-ready reports for SOC 2 and ISO 27001. - [Offensive Security Services](https://www.hacktron.ai/services): Expert-led offensive security engagements combining elite security researchers with frontier models: external and internal AI-assisted red teaming, cloud and firmware assessments, purple team exercises, advisory, and independent review, with live reporting, a final report, and fix verification. - [Dependency Scanner](https://www.hacktron.ai/package): Scan package-lock.json, pnpm-lock.yaml, yarn.lock, uv.lock, and poetry.lock files against 21,000+ known malware advisories instantly. - [Open Source Program](https://www.hacktron.ai/open-source): Free Hacktron PR and MR security reviews for qualifying open source projects. - [Case Studies](https://www.hacktron.ai/customer-stories): Customer stories from teams using Hacktron for security code reviews. - [Security Advisories](https://www.hacktron.ai/advisories): Coordinated disclosures and advisories for vulnerabilities discovered or reported by Hacktron researchers, with Supabase customer evidence for Hacktron security research. - [Security Changelog](https://www.hacktron.ai/security-changelog): Security-only changelog for framework vulnerability fixes, affected versions, fixed versions, CVEs, workarounds, and upstream advisories. - [Blog](https://www.hacktron.ai/blog): Security research, exploit writeups, product updates, and offensive security analysis from Hacktron. - [How Hacktron brings context-aware security review to every change in Nopan’s payments infrastructure](https://www.hacktron.ai/customer-stories/nopan): As code volume and AI-assisted development grow, Nopan uses Hacktron to deepen its security review without slowing continuous delivery. - [How Hacktron brings codebase-wide security context to every hackajob pull request](https://www.hacktron.ai/customer-stories/hackajob): hackajob runs every pull request through Hacktron Review for codebase-wide security context, catching a cross-customer authorization gap before merge. - [How Mobbin achieves near-immediate security triage with Hacktron](https://www.hacktron.ai/customer-stories/mobbin): Mobbin uses Hacktron Review to bring full-codebase security review into every pull request, with a 32-minute median time to triage. - [How Hacktron gives Novu's security team confidence, not more process](https://www.hacktron.ai/customer-stories/novu): How Novu catches cross-file vulnerabilities like NoSQL injection in a codebase 400+ contributors touch, with 83% of triaged findings actionable. - [How Hacktron provides 24/7 security for Rocket.Chat](https://www.hacktron.ai/customer-stories/rocketchat): How Rocket.Chat found and fixed a critical Apple OAuth account takeover (CVE-2026-55666) within days of adding Hacktron to every pull request. - [Why Krisp chose Hacktron for security code reviews](https://www.hacktron.ai/customer-stories/krisp): How Krisp's security team gets high-signal vulnerability detection on every pull request with Hacktron, without slowing down engineering. - [Hacktron vs Snyk](https://www.hacktron.ai/comparison/hacktron-vs-snyk): Comparison of Hacktron and Snyk for application security. - [Hacktron vs Semgrep](https://www.hacktron.ai/comparison/hacktron-vs-semgrep): Comparison of Hacktron and Semgrep for code security review. - [Hacktron vs CodeRabbit](https://www.hacktron.ai/comparison/hacktron-vs-coderabbit): Comparison of Hacktron and CodeRabbit for pull request and merge request review. - [Hacktron vs Aikido](https://www.hacktron.ai/comparison/hacktron-vs-aikido): Comparison of Hacktron and Aikido for application security workflows. - [Hacktron vs Greptile](https://www.hacktron.ai/comparison/hacktron-vs-greptile): Comparison of Hacktron and Greptile for AI-assisted code review. - [Docs](https://docs.hacktron.ai): Product documentation for installing and using Hacktron. - [Start for free](https://app.hacktron.ai/auth/signup): Create a Hacktron account. - [Book a demo](https://www.hacktron.ai/calendar): Schedule a demo with the Hacktron team. - [Contact us](mailto:hello@hacktron.ai): Want to chat? Reach us at hello@hacktron.ai - [RSS](https://www.hacktron.ai/rss.xml): RSS feed for Hacktron research and product posts. - [Sitemap](https://www.hacktron.ai/sitemap-index.xml): XML sitemap for the public website. - [Privacy Policy](https://www.hacktron.ai/privacy-policy): Privacy policy for Hacktron AI Inc. websites, applications, and related services. - [Hacktron Terms of Use](https://www.hacktron.ai/terms-of-service): Terms of use governing access to Hacktron AI Inc. websites and website content. - [Master Services Agreement](https://www.hacktron.ai/master-services-agreement): Master Services Agreement governing Hacktron service orders and subscriptions. - [Service Level Agreement](https://www.hacktron.ai/service-level-agreement): Service Level Agreement for Hacktron availability commitments, credits, and claims. - [Cookie Notice](https://www.hacktron.ai/cookie-notice): Cookie notice for Hacktron websites and related services. ## Published Advisories ### HTAI-028: GitHub - Concurrent upload race leads to GitHub Enterprise Server RCE - URL: https://www.hacktron.ai/advisories - Severity: high - Type: RCE - CVE: CVE-2026-19118 - Date: 2026-09-01 - Affected component: GitHub Enterprise Server concurrent upload handling - Upstream fix: https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.7 An authenticated user with repository write access can exploit a race between concurrent upload requests to execute code on GitHub Enterprise Server. A time-of-check/time-of-use flaw in upload handling allows code execution when an authenticated user with repository write access wins a race between concurrent requests. Exploitation depends on precise timing. **Fixed in:** GitHub Enterprise Server 3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5. Version 3.22 and later are unaffected. **Credit:** ahacker1 and Harsh Jaiswal, as recorded by GitHub. ### HTAI-027: libheif - Duplicate alpha planes trigger a libheif heap overflow - URL: https://www.hacktron.ai/advisories - Severity: critical - Type: RCE - CVE: CVE-2026-84383 - Date: 2026-08-25 - Affected component: scale_nearest_neighbor() alpha-plane handling - Upstream fix: https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497 A crafted HEIF image with nested derived images and duplicate alpha planes can overflow a heap buffer during scaling, allowing remote code execution in applications processing the image. Nested `iden` and `auxl` image relationships can produce duplicate alpha planes that are mishandled by `scale_nearest_neighbor()`. Processing a crafted image can write beyond the allocated heap buffer and lead to code execution in the image-processing application. **Affected versions:** libheif 1.22.0 through 1.23.1. **Fixed in:** 1.23.2. Applications that bundle libheif must update their bundled library as well. **Credit:** Harsh Jaiswal (rootxharsh), finder; hacktronai-research and KarimPwnz, coordinators. ### HTAI-015: WSO2 - JWT algorithm mismatch allows WSO2 authentication bypass - URL: https://www.hacktron.ai/advisories - Severity: critical - Type: Auth Bypass - CVE: CVE-2026-5430 - Date: 2026-08-06 - Affected component: JWT authentication in WSO2 API Manager and related products - Upstream fix: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/ WSO2 JWT authentication accepts unsupported signing algorithms, allowing crafted tokens to bypass authentication and compromise accounts, including administrative accounts. Affected WSO2 products accept JWTs using algorithms outside the configured or supported set. An attacker can exploit the validation mismatch to gain unauthorized access and take over administrative accounts. **Affected products:** API Manager, Universal Gateway, Traffic Manager, API Control Plane, and the Carbon API Manager REST API utility. Install the product-specific updates listed in WSO2-2026-5328. **Credit:** Hacktron Team, as acknowledged by WSO2. **CVE publication:** August 6, 2026. This entry uses the CVE record publication date. ### HTAI-026: Discourse - Malformed HEIF uploads expose Discourse to a libheif vulnerability - URL: https://www.hacktron.ai/advisories - Severity: high - Type: RCE - CVE: CVE-2026-32882 - Date: 2026-07-28 - Affected component: Discourse image upload processing with libheif - Upstream fix: https://github.com/discourse/discourse/security/advisories/GHSA-vhm9-85gw-x335 Discourse disclosed remote code execution through image uploads involving an upstream libheif vulnerability. Hacktron reported the downstream exposure to Discourse. Discourse's advisory identifies malformed HEIF uploads as a route to remote code execution through its libheif dependency. Updated Docker images include a patched library, and supported Discourse releases add image-processing sandboxing where the system kernel supports it. **Remediation:** Rebuild the application using an updated Discourse Docker image and install a supported patched release. The advisory lists 2026.7.0, 2026.6.1, 2026.5.2, and 2026.1.6. **Credit:** Discourse credits hacktronai-research for reporting its downstream exposure. The original libheif advisory credits Hikai for the upstream discovery. ### HTAI-025: Nuxt - Server-island template injection leads to RCE in Nuxt - URL: https://www.hacktron.ai/advisories - Severity: high - Type: RCE - CVE: CVE-2026-71320 - Date: 2026-07-27 - Affected component: Nuxt server-island props and Vue dynamic component resolution - Upstream fix: https://github.com/nuxt/nuxt/security/advisories/GHSA-9473-5f9j-94wq Attacker-controlled server-island props can reach Vue dynamic component resolution and inject a template that executes in the Nitro server process. Nuxt server islands accept props through `/__nuxt_island/`. If an island passes those values into dynamic component resolution, an attacker can supply a `template` property that Vue compiles and executes on the server. Attribute fallthrough to a polymorphic root component can also expose this path. **Affected versions:** Nuxt 3.4.0 through versions before 3.21.10, and Nuxt 4 before 4.5.1, when component islands are active and expose the required dynamic-component path. Node deployments with externalized Vue can be affected even without explicitly enabling `vue.runtimeCompiler`. **Fixed in:** Nuxt 3.21.10 and 4.5.1. **Credit:** Zayne Zhang. ### HTAI-024: GNU Savane - Untrusted input influences authorization in GNU Savane - URL: https://www.hacktron.ai/advisories - Severity: low - Type: Authorization Bypass - CVE: CVE-2026-56355 - Date: 2026-06-20 - Affected component: Savane authorization checks - Upstream fix: https://www.fsf.org/news/fsf-publishes-incident-report-on-gnu-savannah-vulnerabilities GNU Savane uses untrusted data in an authorization decision. The issue affects the software behind GNU Savannah and was addressed through coordinated work with the Free Software Foundation. CVE-2026-56355 identifies an authorization flaw in GNU Savane in which untrusted input influences an access decision. The CVE record lists versions 3.14 through 3.17 as affected. The Free Software Foundation reports that the GNU Savannah issues were resolved and acknowledges Harsh Jaiswal and Rahul Maini from Hacktron for their assistance with mitigation. **Severity:** Low, following the CVE's 3.7 CVSS assessment. ### HTAI-023: Rocket.Chat - Apple OAuth email fallback enables Rocket.Chat account takeover - URL: https://www.hacktron.ai/advisories - Severity: critical - Type: Account Takeover - CVE: CVE-2026-55666 - Date: 2026-06-16 - Affected component: Apple OAuth login handler email fallback - Upstream fix: https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-wx3c-76rf-wpwf When an Apple identity token lacks an email claim, Rocket.Chat accepts an email supplied in the request, allowing an attacker to associate authentication with another user's account. The Apple OAuth login handler falls back to a request-supplied email when the identity token does not include one. Trusting that value allows the attacker to select the account used by the login flow. **Fixed in:** Rocket.Chat 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13. **Credit:** Found by Hacktron's PR scan, as acknowledged by Rocket.Chat. ### HTAI-016: Sonatype - Authenticated RCE via Nexus Repository license deserialization - URL: https://www.hacktron.ai/advisories - Severity: high - Type: RCE - CVE: CVE-2026-10748 - Date: 2026-06-16 - Affected component: Nexus Repository 3 license upload and deserialization - Upstream fix: https://support.sonatype.com/hc/en-us/articles/52335766035603 An authenticated user with licensing privileges can upload a crafted license file to execute operating system commands as the Sonatype Nexus Repository process user. Sonatype Nexus Repository 3 deserializes attacker-controlled data from an uploaded license file. A user with the `nx-licensing-create` privilege can use a crafted license to execute commands with the privileges of the Nexus process. **Affected versions:** Nexus Repository 3 before 3.92.0. **Fixed in:** 3.92.0. **Credit:** Rahul Maini with Hacktron AI, as acknowledged by Sonatype. ### HTAI-022: OpenAI - OpenAI Atlas exposes privileged browser APIs to OpenAI web origins - URL: https://www.hacktron.ai/advisories - Severity: medium - Type: Information Disclosure - CVE: CVE-2026-11326 - Date: 2026-06-05 - Affected component: Atlas privileged browser API origin allowlist - Upstream fix: https://www.cve.org/CVERecord?id=CVE-2026-11326 An XSS vulnerability on forum.openai.com could reach privileged Atlas browser APIs, exposing browsing history and allowing tabs to be opened or closed. OpenAI Atlas exposed privileged browser functions to content served from `*.openai.com`. Cross-site scripting on the OpenAI forum could cross this trust boundary and access browsing history or control tabs. **Fixed in:** Atlas 1.2025.288.15, which restricts the APIs to `*.chatgpt.com`. **Credit:** s1r1us and Sudi of Hacktron, as recorded in the CVE. Hacktron published the research on December 2, 2025; the CVE was published on June 5, 2026. ### HTAI-021: Metabase - Snowflake JDBC file write leads to authenticated Metabase RCE - URL: https://www.hacktron.ai/advisories - Severity: critical - Type: RCE - CVE: CVE-2026-50148 - Date: 2026-05-28 - Affected component: Snowflake JDBC connection handling and database driver files - Upstream fix: https://github.com/metabase/metabase/security/advisories/GHSA-r6x2-rchx-q9g9 A user allowed to configure database connections can point Metabase at a malicious Snowflake server and overwrite a database driver, causing code execution when that driver is loaded. An attacker-controlled Snowflake server can use the JDBC driver to write files on the Metabase host. Replacing a database driver turns the file write into code execution when Metabase next loads that driver. Exploitation requires permission to add or edit a database connection, typically an administrator privilege. **Fixed in:** 0.54.24 / 1.54.24, 0.55.24 / 1.55.24, 0.56.25 / 1.56.25, 0.57.19 / 1.57.19, 0.58.14 / 1.58.14, 0.59.10 / 1.59.10, and 0.60.4 / 1.60.4. The fix packages first-party drivers inside the application archive to prevent replacement on disk. **Credit:** Hacktron AI. ### HTAI-017: Palo Alto Networks - JWT algorithm confusion in GlobalProtect CAS enables VPN auth bypass - URL: https://www.hacktron.ai/advisories - Severity: high - Type: Auth Bypass - CVE: CVE-2026-0265 - Date: 2026-05-14 - Affected component: GlobalProtect Cloud Authentication Service (CAS) JWT verification - Upstream fix: https://security.paloaltonetworks.com/CVE-2026-0265 PAN-OS GlobalProtect deployments using the Cloud Authentication Service (CAS) accept inbound JWTs signed with HS256 using the public CAS token-signing certificate as the HMAC key — classic algorithm confusion. An attacker who can retrieve the public token-signer certificate (reachable via the CAS metadata endpoint using any valid device mTLS cert) can forge tokens for arbitrary users, achieving full VPN authentication bypass with only the target's username. GlobalProtect's Cloud Authentication Service (CAS) is Palo Alto's cloud-hosted SSO broker. Instead of the firewall talking directly to an IdP, it redirects through `cloud-auth-service..apps.paloaltonetworks.com`, which returns a signed JWT back to the firewall after the user authenticates with their IdP. The firewall verifies the JWT using a token-signing certificate shared across all CAS-enrolled devices. In affected PAN-OS versions, the JWT verification routine accepts tokens signed with HS256 using the public CAS token-signer certificate as the HMAC key — a classic algorithm-confusion bug. Any party able to fetch the public certificate (which is served by the CAS metadata endpoint, reachable using any valid device mTLS client cert) can forge tokens for arbitrary users. **Exploitation requirements:** - The target's username (typically the user's email address). - The device's CSP (CAS) account ID, which can be derived from the device serial number leaked in the outbound login JWT, then resolved via the Palo Alto license API (`license.api.paloaltonetworks.com/entitlements/v1/device?serialNumber=`) with any registered device's mTLS cert. - The public token-signing certificate from the CAS metadata endpoint. **Result:** full GlobalProtect VPN authentication bypass against deployments configured with CAS as the auth backend — the attacker connects to the corporate VPN as the target user with knowledge of only their username. Research by [@rootxharsh](/blog/cve-2026-0265-panos-globalprotect-cas-auth-bypass). See Palo Alto's security advisory for affected versions and patched releases. ### HTAI-014: Next.js - XSS in App Router applications using CSP nonces - URL: https://www.hacktron.ai/advisories - Severity: high - Type: XSS - CVE: CVE-2026-44581 - Date: 2026-05-08 - Affected component: App Router CSP nonce handling - Upstream fix: https://github.com/vercel/next.js/security/advisories/GHSA-ffhc-5mcf-pf4q App Router applications using CSP nonces deployed behind shared caches are vulnerable to stored XSS. Malformed nonce values derived from request headers can be reflected into rendered HTML, allowing an attacker to poison cached responses and execute script for later visitors. App Router applications that use Content Security Policy nonces can be vulnerable to stored cross-site scripting when deployed behind a shared cache. Next.js derives the per-request CSP nonce from request headers in order to apply it to rendered HTML. In affected versions, malformed nonce values were not sufficiently sanitized before being embedded into the response, allowing an attacker to break out of the intended attribute context and inject script into the rendered HTML. When the response is served from a shared cache (CDN, reverse proxy), the poisoned output is replayed to subsequent visitors, turning the CSP-nonce mechanism — normally a defense against XSS — into a stored XSS vector. **Affected versions:** `>= 13.4.0 < 15.5.16` and `>= 16.0.0 < 16.2.5` **Fixed in:** 15.5.16, 16.2.5 **CVSS 3.1:** 4.7 (Moderate) — `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N` The fix rejects or ignores malformed nonce values before they are embedded into HTML and applies stricter sanitization so request-derived nonce data cannot break out of the attribute context. **Workaround:** strip inbound `Content-Security-Policy` request headers from untrusted traffic at the edge until upgrading. ### HTAI-013: Next.js - SSRF in applications using WebSocket upgrades - URL: https://www.hacktron.ai/advisories - Severity: high - Type: SSRF - CVE: CVE-2026-44578 - Date: 2026-05-08 - Affected component: WebSocket upgrade handler (self-hosted Node.js server) - Upstream fix: https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r Self-hosted Next.js apps using the built-in Node.js server are vulnerable to SSRF via crafted WebSocket upgrade requests. An unauthenticated attacker can cause the server to issue an internal HTTP request to any reachable host/port — including cloud metadata endpoints (AWS IMDSv1, GCP, Azure, OCI) — and read the response. Vercel-hosted deployments are unaffected. Self-hosted Next.js applications using the built-in Node.js server can be coerced into server-side request forgery through crafted WebSocket upgrade requests. By sending a single crafted HTTP request that combines a WebSocket `Upgrade` header with an absolute-form URI, an unauthenticated attacker can convince the Next.js process to proxy the request to any host and port reachable from the server, then return the response to the attacker. This includes cloud metadata services on port 80 — AWS IMDSv1, GCP metadata, Azure IMDS, Oracle OCI, DigitalOcean metadata — as well as internal administrative panels and APIs. The HTTP request handler already gated proxy calls behind a routing-completion check; the WebSocket upgrade handler did not. The fix applies the same safety check: upgrade requests are only proxied when routing has explicitly marked them as safe external rewrites (destructuring `finished` and `statusCode` from `resolveRoutes` and gating the proxy call on `finished && parsedUrl.protocol && !statusCode`). **Affected versions:** `>= 13.4.13 < 15.5.16` and `>= 16.0.0 < 16.2.5` — self-hosted only. **Not affected:** Vercel-hosted deployments. **Fixed in:** 15.5.16, 16.2.5 **CVSS 3.1:** 8.6 (High) — `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N` **CWE-918:** Server-Side Request Forgery. Approximately 79,000 Shodan-indexed Next.js hosts on the default port were exposed at disclosure time. ### HTAI-009: Next.js - Middleware / Proxy bypass via dynamic route parameter injection - URL: https://www.hacktron.ai/advisories - Severity: high - Type: Auth Bypass - CVE: CVE-2026-44574 - Date: 2026-05-08 - Affected component: Dynamic route parameter normalization in routing pipeline - Upstream fix: https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv Specially crafted query parameters can alter the dynamic route value seen by the page while leaving the visible path unchanged, allowing protected content to be rendered without passing the expected middleware check. Applications relying on middleware to authorize dynamic routes can be bypassed. Next.js middleware is commonly used as the gatekeeper for authentication and authorization on dynamic routes. In affected versions, specially crafted query parameters can alter the dynamic route value seen by the rendered page while leaving the path observed by middleware unchanged. An attacker can therefore reach a protected dynamic route handler (and have it render protected content) without their request ever appearing to middleware as a request to that route. Applications relying on middleware path matching as their primary authorization layer can be bypassed. The fix only honors internal route-parameter normalization in trusted routing flows and rejects externally-supplied encodings that would diverge from the visible path. **Affected versions:** `>= 15.4.0 < 15.5.16` and `>= 16.0.0 < 16.2.5` **Fixed in:** 15.5.16, 16.2.5 **CVSS 3.1:** 8.1 (High) — `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N` **CWE-288:** Authentication Bypass Using an Alternate Path or Channel. **Workaround:** until upgrading, implement authorization logic at the route or page level rather than relying exclusively on middleware path matching. ### HTAI-020: GitHub - OAuth callback validation bypass in GitHub Enterprise Server - URL: https://www.hacktron.ai/advisories - Severity: high - Type: Auth Bypass - CVE: CVE-2026-4296 - Date: 2026-04-21 - Affected component: GitHub Enterprise Server OAuth callback URL validation - Upstream fix: https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.1 A crafted authorization link can bypass OAuth redirect URI validation and send a victim's authorization code to an attacker-controlled domain, exposing the account within the application's granted scopes. An incorrect regular expression permits OAuth callback URLs that should be rejected. An attacker who knows a first-party OAuth application's registered callback URL can craft an authorization link that redirects the resulting code to a domain they control when a victim follows it. **Fixed in:** GitHub Enterprise Server 3.14.26, 3.15.21, 3.16.17, 3.17.14, 3.18.8, 3.19.5, and 3.20.1. Version 3.21 and later are unaffected. **Credit:** ahacker1 and hacktron, as recorded by GitHub. ### HTAI-008: OAuth2 Proxy - Health Check User-Agent Matching Bypasses Authentication in auth_request Mode - URL: https://www.hacktron.ai/advisories - Severity: critical - Type: Auth Bypass - CVE: CVE-2026-34457 - Date: 2026-04-14 - Affected component: Health check User-Agent matching (--ping-user-agent / --gcp-healthchecks) - Upstream fix: https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-5hvv-m4w4-gf6v When oauth2-proxy is used in auth_request integrations with --ping-user-agent or --gcp-healthchecks enabled, any request bearing the configured health check User-Agent bypasses authentication regardless of the requested path. When oauth2-proxy is used in `auth_request` integrations (e.g. nginx `auth_request`) with `--ping-user-agent` set or `--gcp-healthchecks` enabled, oauth2-proxy treats any request bearing the configured health check `User-Agent` as a successful health check — regardless of the requested path. An unauthenticated attacker can spoof this `User-Agent` string to bypass authentication and access any protected upstream resource without completing the normal login flow. The health check path bypass was not scoped to health check endpoints only, so the `User-Agent` match applied globally across all paths evaluated in `auth_request` subrequests. **Conditions for impact:** - `auth_request`-style subrequest integration (e.g. nginx `auth_request`) - `--ping-user-agent` is set OR `--gcp-healthchecks` is enabled Fixed in v7.15.2. Workaround: ensure the reverse proxy does not forward client-controlled `User-Agent` headers to the oauth2-proxy auth subrequest. ```nginx location = /oauth2/auth { internal; proxy_set_header User-Agent "oauth2-proxy-auth-request"; proxy_pass http://127.0.0.1:4180; } ``` ### HTAI-007: OAuth2 Proxy - Authentication Bypass via X-Forwarded-Uri Header Spoofing - URL: https://www.hacktron.ai/advisories - Severity: critical - Type: Auth Bypass - CVE: CVE-2026-40575 - Date: 2026-04-14 - Affected component: X-Forwarded-Uri header trust in --reverse-proxy mode with skip_auth_routes - Upstream fix: https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-7x63-xv5r-3p2x When oauth2-proxy is configured with --reverse-proxy and skip_auth_routes, it may trust a client-supplied X-Forwarded-Uri header, allowing an unauthenticated attacker to spoof the header and bypass authentication on protected routes. When oauth2-proxy is configured with `--reverse-proxy` and at least one `--skip-auth-route` or `--skip-auth-regex` rule, it may trust a client-supplied `X-Forwarded-Uri` header. An attacker can spoof this header to make oauth2-proxy evaluate authentication and skip-auth rules against a different path than what is actually forwarded to the upstream. This allows an unauthenticated remote attacker to bypass authentication and access protected routes without a valid session. **Conditions for impact:** - `--reverse-proxy` flag is enabled - At least one `--skip-auth-route` or `--skip-auth-regex` rule is defined Fixed in v7.15.2, which introduces a `--trusted-proxy-ip` flag. If left unset, oauth2-proxy continues to trust all source IPs for backwards compatibility — operators must explicitly configure trusted proxy IPs after upgrading. Workaround: strip any client-provided `X-Forwarded-Uri` header at the reverse proxy before it reaches oauth2-proxy, and overwrite it with the actual `$request_uri`. ```nginx location /internal-auth/ { internal; proxy_set_header X-Forwarded-Uri $request_uri; proxy_pass http://oauth2-proxy:4180/; } ``` ### HTAI-006: OAuth2 Proxy - Authentication Bypass via Fragment Confusion in skip_auth_routes - URL: https://www.hacktron.ai/advisories - Severity: high - Type: Auth Bypass - CVE: CVE-2026-41059 - Date: 2026-04-14 - Affected component: skip_auth_routes / skip_auth_regex path matching logic - Upstream fix: https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-pxq7-h93f-9jrg A configuration-dependent authentication bypass in oauth2-proxy where an attacker can use a # fragment in the request path to widen skip_auth_routes or skip_auth_regex patterns, causing oauth2-proxy to match a public allowlist rule while the backend routes to a protected resource. A configuration-dependent authentication bypass exists when `skip_auth_routes` or `skip_auth_regex` are used with patterns that can be widened by attacker-controlled suffixes (e.g. `^/foo/.*/bar$`). An unauthenticated attacker can send a crafted request containing a `#` (or URL-encoded `%23`) in the path, causing oauth2-proxy to match a public allowlist rule while the backend routes the request to a protected resource. The `#` character is a fragment delimiter — the backend sees a different effective path than what oauth2-proxy evaluated for skip-auth matching. **Conditions for impact:** - Uses `skip_auth_routes` or `skip_auth_regex` - Patterns use broad wildcards across path segments - Backend interprets `#` as a fragment delimiter Fixed in v7.15.2 by making path normalization more conservative before skip-auth matching, so fragment content cannot influence allowlist decisions. Workaround: tighten or remove broad `skip_auth_routes` patterns, replace with exact anchored paths with explicit HTTP methods, or reject requests containing `%23` or `#` in the path at the ingress/WAF level. ### HTAI-005: JetBrains - YouTrack Sandbox Bypass Allowing Code Execution - URL: https://www.hacktron.ai/advisories - Severity: high - Type: RCE - CVE: CVE-2026-33392 - Date: 2026-04-09 - Affected component: YouTrack server runtime sandbox - Upstream fix: https://blog.jetbrains.com/youtrack/2026/04/security-issue-in-youtrack-cve-2026-33392/ A sandbox bypass vulnerability in YouTrack allows an attacker with administrator-level permissions to execute arbitrary code. On YouTrack Cloud, this could bypass cross-tenant isolation boundaries for tenants sharing the same hardware. A sandbox bypass vulnerability in JetBrains YouTrack allows an attacker with administrator-level permissions to escape the server runtime sandbox and execute arbitrary code. The impact differs across deployment types. On YouTrack Cloud, where multiple tenants share underlying hardware, a successful exploit could bypass cross-tenant isolation boundaries, potentially exposing data from other tenants on the same host. On YouTrack Server (single-tenant), the vulnerability allows privilege escalation within administrative roles but cannot cross tenant boundaries. JetBrains implemented a mitigation within 48 hours of receiving the report and found no evidence of exploitation in any environment. YouTrack Cloud was patched automatically. **Affected versions:** All YouTrack versions before 2025.3.132953 **Fixed version:** 2025.3.132953 and later YouTrack Server administrators should upgrade to 2025.3.132953 or later. ### HTAI-003: OpenAM - Pre-Authentication Remote Code Execution via jato.clientSession Deserialization in OpenAM - URL: https://www.hacktron.ai/advisories - Severity: critical - Type: RCE - CVE: CVE-2026-33439 - Date: 2026-03-20 - Affected component: jato.clientSession Deserialization Handler - Upstream fix: https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-2cqq-rpvq-g5qj Pre-Authentication Remote Code Execution via jato.clientSession Deserialization in OpenAM. OpenAM's authentication endpoint contains a pre-authentication remote code execution vulnerability through unsafe deserialization of the `jato.clientSession` parameter. The `jato.clientSession` parameter is processed by the Jato framework's view bean infrastructure before any authentication logic executes. An attacker can craft a malicious serialized Java object and send it as the `jato.clientSession` value in a request to any OpenAM authentication endpoint. The deserialization occurs in `ClientSession.deserializeAttributes()`, which calls `Encoder.deserialize()` → `ApplicationObjectInputStream.readObject()` with no whitelist filtering. The fix for `jato.pageSession` (CVE-2021-35464) was never applied to this parallel code path. ```java protected void deserializeAttributes() { if (this.encodedSessionString != null && this.encodedSessionString.trim().length() > 0) { this.setAttributes( (Map) Encoder.deserialize( Encoder.decodeHttp64(this.encodedSessionString), false)); } } ``` With Click-style gadget chains bundled in OpenAM's classpath (repackaged under `org.openidentityplatform.openam.click.control`), an unauthenticated attacker can achieve full remote code execution. ### HTAI-002: Metabase - Authenticated RCE and Arbitrary File Read via EE Serialization Import in Metabase - URL: https://www.hacktron.ai/advisories - Severity: high - Type: RCE - CVE: CVE-2026-33725 - Date: 2026-03-20 - Affected component: Enterprise Edition Serialization Import - Upstream fix: https://github.com/metabase/metabase/security/advisories/GHSA-fppj-vcm3-w229 Authenticated users on Metabase Enterprise Edition can achieve Remote Code Execution (RCE) and Arbitrary File Read through the EE Serialization Import endpoint. Metabase Enterprise Edition contains a vulnerability in its serialization import functionality that allows authenticated users to achieve Remote Code Execution and Arbitrary File Read. The EE Serialization Import endpoint accepts serialized data bundles intended for migrating Metabase instances. Insufficient validation of the imported payload allows an authenticated user to craft a malicious serialization bundle that executes arbitrary code on the server when imported. The import process can also be abused to read arbitrary files from the server filesystem by crafting payloads that reference local file paths. ```clojure (defn import-serialized-data [import-path] ;; Vulnerable: path traversal allows reading arbitrary files (let [files (file-seq (io/file import-path))] (doseq [f files] (when (.isFile f) ;; Deserializes without validating content type (let [data (read-string (slurp f))] (process-import-entity! data)))))) ``` The `import-serialized-data` function does not sanitize file paths within the import bundle, and `read-string` evaluates Clojure expressions, enabling code execution. ### HTAI-001: BeyondTrust - Pre-Auth RCE in BeyondTrust Remote Support & PRA - URL: https://www.hacktron.ai/advisories - Severity: critical - Type: RCE - CVE: CVE-2026-1731 - Date: 2026-02-06 - Affected component: Remote Support & PRA Authentication Handler - Upstream fix: https://www.beyondtrust.com/trust-center/security-advisories Pre-Authentication Remote Code Execution via deserialization vulnerability in BeyondTrust Remote Support and Privileged Remote Access (PRA) products. BeyondTrust Remote Support and Privileged Remote Access (PRA) products contain a pre-authentication remote code execution vulnerability in the session deserialization handler. An unauthenticated attacker can send a crafted serialized session object to the authentication endpoint, which is deserialized without proper validation. By manipulating the serialized payload, the attacker can execute arbitrary code on the server with the privileges of the BeyondTrust service account. This vulnerability was discovered through Hacktron AI's variant analysis capabilities and was responsibly disclosed to BeyondTrust. ### HTAI-019: NestJS - URL encoding bypasses route-specific NestJS Fastify middleware - URL: https://www.hacktron.ai/advisories - Severity: high - Type: Auth Bypass - CVE: CVE-2025-69211 - Date: 2025-12-29 - Affected component: @nestjs/platform-fastify middleware route matching - Upstream fix: https://github.com/nestjs/nest/security/advisories/GHSA-8wpr-639p-ccrj NestJS applications using the Fastify adapter can skip route-specific authentication, authorization, or validation middleware through encoded request paths. A path-normalization mismatch allows encoded requests to reach a NestJS route without executing the middleware assigned to that route. Applications are affected when they use `@nestjs/platform-fastify` and rely on route-specific middleware for security checks. **Fixed in:** `@nestjs/platform-fastify` 11.1.11. Upgrade the adapter and enforce authorization in guards or handlers as appropriate. **Credit:** Hacktron AI. ### HTAI-018: Astro - URL-encoded paths bypass Astro middleware authentication - URL: https://www.hacktron.ai/advisories - Severity: medium - Type: Auth Bypass - CVE: CVE-2025-64765 - Date: 2025-11-19 - Affected component: Request path normalization and middleware routing - Upstream fix: https://github.com/withastro/astro/security/advisories/GHSA-ggxq-hp9w-j794 A mismatch between Astro routing and middleware path normalization lets encoded URLs reach protected routes while bypassing authentication checks based on url.pathname. Astro decodes request paths when selecting a route, while application middleware can check the encoded `context.url.pathname`. An encoded path can therefore reach a protected page without matching the middleware's authentication rule. **Affected versions:** Astro before 5.15.8. **Fixed in:** 5.15.8. **Credit:** Sudi (Sudistark), as acknowledged in the Astro advisory. ## Security Changelog ### Next.js: Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service - URL: https://www.hacktron.ai/security-changelog/nextjs#nextjs-ghsa-mcj8-r9mp-w47p - Severity: medium - CVE: CVE-2026-94484 - Date: 2026-10-07 - Affected component: next - Affected versions: >= 16.0.0, < 16.3.8; >= 15.0.0, < 15.5.27 - Fixed versions: 15.5.27, 16.3.8 - Upstream fix: https://github.com/vercel/next.js/security/advisories/GHSA-mcj8-r9mp-w47p Next.js applications that use a root-level catch-all page together with statically generated or Incremental Static Regeneration routes can have their shared response cache poisoned by a single unauthenticated crafted request. ### Next.js: Next.js has cache poisoning of SSG and ISR pages in self-hosted applications - URL: https://www.hacktron.ai/security-changelog/nextjs#nextjs-ghsa-4jqv-mc3x-m676 - Severity: medium - CVE: CVE-2026-94543 - Date: 2026-10-07 - Affected component: next - Affected versions: >= 15.0.0, < 15.5.27; >= 16.0.0, < 16.3.8 - Fixed versions: 15.5.27, 16.3.8 - Upstream fix: https://github.com/vercel/next.js/security/advisories/GHSA-4jqv-mc3x-m676 Self-hosted Next.js applications that use the Pages Router with statically generated (SSG) or incrementally regenerated (ISR) pages can have a page's cache entry replaced with content from a different route, causing the affected page to serve wrong content to every visitor until the entry is revalidated. Applications deployed on Vercel are not affected. ### Next.js: Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass - URL: https://www.hacktron.ai/security-changelog/nextjs#nextjs-ghsa-f87g-xv8r-7p7x - Severity: medium - CVE: CVE-2026-94485 - Date: 2026-10-07 - Affected component: next - Affected versions: >= 16.0.0, < 16.3.8 - Fixed versions: 16.3.8 - Upstream fix: https://github.com/vercel/next.js/security/advisories/GHSA-f87g-xv8r-7p7x In Next.js App Router applications built with webpack, metadata image routes such as opengraph-image and twitter-image ignore the `dynamicParams` route segment option. An attacker can request metadata image URLs for dynamic segments that were deliberately excluded from `generateStaticParams()`. ### Next.js: Next.js has information disclosure in development server's Model Context Protocol endpoint - URL: https://www.hacktron.ai/security-changelog/nextjs#nextjs-ghsa-39w2-rjm5-chcv - Severity: low - CVE: CVE-2026-94486 - Date: 2026-10-07 - Affected component: next - Affected versions: >= 16.0.0, < 16.3.8 - Fixed versions: 16.3.8 - Upstream fix: https://github.com/vercel/next.js/security/advisories/GHSA-39w2-rjm5-chcv The Next.js development server (`next dev`) exposes a Model Context Protocol endpoint that does not verify which website a request originates from, allowing a malicious website visited by the developer to read sensitive development data — including the project's location on disk, source code snippets from error reports, the route inventory, and development logs. Only applications run with `next dev` are affected. Production deployments do not serve this endpoint. ### Next.js: Next.js has Server-Side Request Forgery in Image Optimization - URL: https://www.hacktron.ai/security-changelog/nextjs#nextjs-ghsa-cjq9-62q9-8jv4 - Severity: high - CVE: CVE-2026-94483 - Date: 2026-10-07 - Affected component: next - Affected versions: >= 16.0.0, < 16.3.8 - Fixed versions: 16.3.8 - Upstream fix: https://github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4 ## Impact An attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs) during Image Optimization. ## Workaround Audit allow-listed remote URLs in `images.remotePatterns` (see https://nextjs.org/docs/app/getting-started/images#remote-images) for hosts that may not be trusted with their DNS entries. If no `images.remotePatterns` are configured, your app is not affected. ### Next.js: Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages - URL: https://www.hacktron.ai/security-changelog/nextjs#nextjs-ghsa-3w37-wq28-93x7 - Severity: medium - CVE: CVE-2026-94544 - Date: 2026-10-07 - Affected component: next - Affected versions: >= 16.3.0, < 16.3.8 - Fixed versions: 16.3.8 - Upstream fix: https://github.com/vercel/next.js/security/advisories/GHSA-3w37-wq28-93x7 Pending `use cache` fills are shared across requests for the same key without distinguishing Draft Mode requests from regular requests. When two such requests overlap, the second request receives the first request's fill: - A regular request that overlaps an editor's Draft Mode request receives unpublished content, without any authentication. - A Draft Mode request that overlaps a regular request receives published content instead of the draft. If the overlapping regular request prerenders a page — for example a… ### Next.js: Next.js: Remote Code Execution in next/og ImageResponse - URL: https://www.hacktron.ai/security-changelog/nextjs#nextjs-ghsa-vcvr-r3jv-pc5j - Severity: critical - CVE: Not listed - Date: 2026-09-30 - Affected component: next - Affected versions: >= 16.2.0, < 16.3.6 - Fixed versions: 16.3.6 - Upstream fix: https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j ## Impact The Node.js `ImageResponse` implementation from `next/og` is affected by an upstream vulnerability. This can lead to remote code execution. Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation: ```tsx import { ImageResponse } from 'next/og' export async function GET(request: Request) { const value = new URL(request.url).searchParams.get('value') ?? '' return new ImageResponse( {value… ### Astro: Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base - URL: https://www.hacktron.ai/security-changelog/astro#astro-ghsa-376h-93r7-7g6f - Severity: medium - CVE: CVE-2026-84376 - Date: 2026-09-08 - Affected component: astro - Affected versions: <= 7.2.3 - Fixed versions: 7.2.4 - Upstream fix: https://github.com/withastro/astro/security/advisories/GHSA-376h-93r7-7g6f ## Summary Astro stripped a configured `base` path from request pathnames using a string-prefix check that did not verify a path-segment boundary. With `base: "/app"`, a request to `/appX/admin` was treated as being under the base and resolved internally to the `/admin` route, while middleware still observed the public pathname `/appX/admin`. Middleware that authorizes routes by inspecting `context.url.pathname` could therefore be bypassed. ## Impact An unauthenticated remote attacker can bypass pathname-based… ### Astro: Astro: Remote code execution through AVIF image optimization - URL: https://www.hacktron.ai/security-changelog/astro#astro-ghsa-26w7-cxv4-gfx2 - Severity: critical - CVE: Not listed - Date: 2026-09-08 - Affected component: astro - Affected versions: < 7.2.8 - Fixed versions: 7.2.8 - Upstream fix: https://github.com/withastro/astro/security/advisories/GHSA-26w7-cxv4-gfx2 A vulnerability in `libheif`, used by the default Sharp image service in Astro, can lead to remote code execution when a malicious AVIF image is optimized. Projects are affected when an attacker can cause Astro to process an untrusted AVIF image. The fix was released in Astro 7.2.8, which requires Sharp 0.35.4. ### Next.js: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used - URL: https://www.hacktron.ai/security-changelog/nextjs#nextjs-ghsa-2xp9-vwfh-vxw4 - Severity: critical - CVE: Not listed - Date: 2026-09-08 - Affected component: next - Affected versions: >= 10.0.0, < 15.5.24; >= 16.0.0, < 16.3.3 - Fixed versions: 15.5.24, 16.3.3 - Upstream fix: https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4 A vulnerability in the underlying `libheif` library used by `sharp` which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized. Until a fix has propagated, optimization of AVIF files is disabled. ### Next.js: Next.js: Unauthenticated Remote Code Execution on windows-hosted servers - URL: https://www.hacktron.ai/security-changelog/nextjs#nextjs-ghsa-p293-qw3h-jr36 - Severity: critical - CVE: CVE-2026-75604 - Date: 2026-09-08 - Affected component: next - Affected versions: >= 13.4.0, < 15.5.24; >= 16.0.0, < 16.3.3 - Fixed versions: 15.5.24, 16.3.3 - Upstream fix: https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36 ## Impact A vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem. ## Workaround There is no known workaround for affected windows-hosted applications. You should upgrade immediately if your server is hosted on Windows. ### Nuxt: Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint - URL: https://www.hacktron.ai/security-changelog/nuxt#nuxt-ghsa-7c4v-fwgw-9rf7 - Severity: medium - CVE: CVE-2026-72744 - Date: 2026-08-07 - Affected component: nuxt - Affected versions: >= 4.4.7, < 4.5.1; >= 3.21.7, < 3.21.10 - Fixed versions: 3.21.10, 4.5.1 - Upstream fix: https://github.com/nuxt/nuxt/security/advisories/GHSA-7c4v-fwgw-9rf7 ### Impact When a Nuxt dev server is bound to a network-reachable interface (for example `nuxt dev --host` for on-device testing), the default-enabled Chrome DevTools workspace endpoint `GET /.well-known/appspecific/com.chrome.devtools.json` returns the absolute project root (`workspace.root`, i.e. `rootDir`) and a persistent per-project workspace UUID. `GHSA-rq7w-g337-39qq` added a gate (`isLocalDevRequest`) intended to restrict this endpoint to local requests, but that gate is header-based: it trusts request m… ### Nuxt: Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721) - URL: https://www.hacktron.ai/security-changelog/nuxt#nuxt-ghsa-hxvh-4h3w-prp9 - Severity: high - CVE: CVE-2026-71315 - Date: 2026-08-05 - Affected component: nuxt - Affected versions: >= 4.4.7, < 4.5.1; >= 3.21.7, < 3.21.10 - Fixed versions: 3.21.10, 4.5.1 - Upstream fix: https://github.com/nuxt/nuxt/security/advisories/GHSA-hxvh-4h3w-prp9 ### Impact Nuxt matches route rules case-insensitively by default (mirroring vue-router's default `sensitive: false` routing). The fix for GHSA-mm7m-92g8-7m47 / CVE-2026-53721 lowercased the *lookup* path before matching route rules, but the route-rule *keys* compiled into the matcher were left verbatim. As a result, any route rule whose key contains an uppercase character (for example `/Admin`, `/Dashboard/**`, or the rules Nuxt derives from PascalCase/camelCase page files such as `pages/Admin.vue`) never matche… ### Nuxt: Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients - URL: https://www.hacktron.ai/security-changelog/nuxt#nuxt-ghsa-wm8w-6qjm-cv43 - Severity: high - CVE: CVE-2026-71316 - Date: 2026-08-05 - Affected component: nuxt - Affected versions: >= 4.4.0, <= 4.5.0 - Fixed versions: 4.5.1 - Upstream fix: https://github.com/nuxt/nuxt/security/advisories/GHSA-wm8w-6qjm-cv43 ### Impact When a page is covered by `routeRules` `cache` / `swr` / `isr`, Nuxt enables runtime payload extraction and serves `//_payload.json`. On affected versions the renderer stored the SSR payload in the shared `cache:nuxt:payload` storage under a path-only key (no cookie, `authorization`, or `cache.varies` dimension) and, on a later payload request, returned the cached entry before route middleware / page guards ran again. As a result, once any authenticated user warms a protected, cached page, a sub… ### Nuxt: Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation - URL: https://www.hacktron.ai/security-changelog/nuxt#nuxt-ghsa-9pgf-384g-p7mv - Severity: high - CVE: CVE-2026-71321 - Date: 2026-08-05 - Affected component: nuxt - Affected versions: >= 4.0.0, < 4.5.1; >= 3.1.0, < 3.21.10 - Fixed versions: 3.21.10, 4.5.1 - Upstream fix: https://github.com/nuxt/nuxt/security/advisories/GHSA-9pgf-384g-p7mv ### Impact The internal island renderer endpoint (`/__nuxt_island/...`) decodes and hashes attacker-controlled request input before it validates the URL-resident hash. An unauthenticated `POST /__nuxt_island/_.json` with a large JSON body (for example ~4.6 MB / 150k keys) is fully read, `destr`-parsed, and run through `ohash` before the request is rejected with a 400. Because Nitro runs on a single event loop, this both wastes CPU on the doomed request and delays every concurrent request. A low re… ### Nuxt: Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering - URL: https://www.hacktron.ai/security-changelog/nuxt#nuxt-ghsa-hxcr-hm88-mpq6 - Severity: high - CVE: CVE-2026-71314 - Date: 2026-08-05 - Affected component: nuxt - Affected versions: >= 4.0.0, < 4.5.1; >= 3.1.0, < 3.21.10 - Fixed versions: 3.21.10, 4.5.1 - Upstream fix: https://github.com/nuxt/nuxt/security/advisories/GHSA-hxcr-hm88-mpq6 ### Impact An unauthenticated attacker can crash a Nuxt server that renders any island / server component containing a `v-for` over a prop (for example `v-for="n in count"` or a ``). Because the island URL hash is a non-secret digest of the request, the attacker can compute a valid hash for arbitrary props and send the iterated prop as a large integer. The server then expands the `v-for` to that many nodes during SSR, allocating memory proportional to the attacker's number. Reporter figures: `count=80… ### Nuxt: Nuxt: Unauthorized Component Instantiation via Server Island Props - URL: https://www.hacktron.ai/security-changelog/nuxt#nuxt-ghsa-48hr-524c-v5w3 - Severity: medium - CVE: CVE-2026-71318 - Date: 2026-08-05 - Affected component: nuxt - Affected versions: >= 4.0.0, < 4.5.1; >= 3.1.0, < 3.21.10 - Fixed versions: 3.21.10, 4.5.1 - Upstream fix: https://github.com/nuxt/nuxt/security/advisories/GHSA-48hr-524c-v5w3 ## Impact Nuxt server islands accept props via the `/__nuxt_island/` endpoint. When an application has a server island component that forwards props directly into Vue's dynamic component resolution (``, `resolveDynamicComponent`, or `h()`), an attacker can pass a plain string value (rather than a component definition) to instantiate any globally-registered Vue component or any native HTML element. For example: ```json { "as": "SomeGlobalComponent" } ``` ...resolves and renders `SomeGlobalComponen… ### Next.js: Next.js: Cache confusion of response bodies for requests with bodies - URL: https://www.hacktron.ai/security-changelog/nextjs#nextjs-ghsa-68g3-v927-f742 - Severity: medium - CVE: CVE-2026-64648 - Date: 2026-07-22 - Affected component: next - Affected versions: >= 13.0.0, < 15.5.21; >= 16.0.0, < 16.2.11 - Fixed versions: 15.5.21, 16.2.11 - Upstream fix: https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742 ## Impact A server-side `fetch` with a request body may return a cached **response** body from a different request to the same URL but different body. Confidential data in the `POST`'s **response** body would then leak to unauthorized requests. Though the request itself will not be deduped. This only applies to `fetch` calls with a request that has a different init than the one passed to `fetch`. Safe: `fetch(new Request(init), init)` Unsafe: `fetch(new Request(init), aDifferentInit)` ## Workarounds No workaro… ### Next.js: Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences - URL: https://www.hacktron.ai/security-changelog/nextjs#nextjs-ghsa-4633-3j49-mh5q - Severity: medium - CVE: CVE-2026-64647 - Date: 2026-07-22 - Affected component: next - Affected versions: >= 13.0.0, < 15.5.21; >= 16.0.0, < 16.2.11 - Fixed versions: 15.5.21, 16.2.11 - Upstream fix: https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q ## Impact A server-side `fetch` with a request body may return a cached **response** body from a different request to the same URL but different body. Confidential data in the `POST`'s **response** body would then leak to unauthorized requests. Though the request itself will not be deduped. This is only an issue when receiving request bodies with a content type charset other than UTF-8. For example, the UTF-16 byte sequences for `삃삃` and `섄섄` in the request body would share the same cache. ## Workarounds If yo… ### Next.js: Next.js: Denial of Service in App Router using Server Actions - URL: https://www.hacktron.ai/security-changelog/nextjs#nextjs-ghsa-m99w-x7hq-7vfj - Severity: high - CVE: CVE-2026-64641 - Date: 2026-07-22 - Affected component: next - Affected versions: >= 13.0.0, < 15.5.21; >= 16.0.0, < 16.2.11 - Fixed versions: 15.5.21, 16.2.11 - Upstream fix: https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj ## Impact Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. ## Workarounds No workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable. ### Next.js: Next.js: Denial of Service in the Image Optimization API using SVGs - URL: https://www.hacktron.ai/security-changelog/nextjs#nextjs-ghsa-q8wf-6r8g-63ch - Severity: medium - CVE: CVE-2026-64644 - Date: 2026-07-22 - Affected component: next - Affected versions: >= 15.5.0, < 15.5.21; >= 16.0.0, < 16.2.11 - Fixed versions: 15.5.21, 16.2.11 - Upstream fix: https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch ### Impact When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in `/_next/image` endpoints. - If you are using `config.images.remotePatterns`, only the patterns in that array are impacted. - If you are using `config.images.unoptimized: true`, you are NOT impacted. - If you are using `config.images.loader: 'custom'`, you are NOT impac… ### Next.js: Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale - URL: https://www.hacktron.ai/security-changelog/nextjs#nextjs-ghsa-6gpp-xcg3-4w24 - Severity: high - CVE: CVE-2026-64642 - Date: 2026-07-22 - Affected component: next - Affected versions: >= 16.0.0, < 16.2.11 - Fixed versions: 16.2.11 - Upstream fix: https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24 ## Impact Crafted requests targeting Next.js applications using App Router built with Turbopack and a **single** entry in `config.i18n.locales` can bypass middleware/proxy based authentication. ## Workarounds If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware. ### Next.js: Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname - URL: https://www.hacktron.ai/security-changelog/nextjs#nextjs-ghsa-p9j2-gv94-2wf4 - Severity: high - CVE: CVE-2026-64645 - Date: 2026-07-22 - Affected component: next - Affected versions: >= 12.0.0, < 15.5.21; >= 16.0.0, < 16.2.11 - Fixed versions: 15.5.21, 16.2.11 - Upstream fix: https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4 ## Impact A `rewrites()` or `redirects()` rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application's origin, leading to Server-Side Request forgery. A `redirects()` rule configured this way is vulnerable to an Open Redirect. This affects any destination that puts a dynamic segment in the hostname,… ### Next.js: Next.js: Server-Side Request Forgery in Server Actions on custom servers - URL: https://www.hacktron.ai/security-changelog/nextjs#nextjs-ghsa-89xv-2m56-2m9x - Severity: high - CVE: CVE-2026-64649 - Date: 2026-07-22 - Affected component: next - Affected versions: >= 14.1.1, < 15.5.21; >= 16.0.0, < 16.2.11 - Fixed versions: 15.5.21, 16.2.11 - Upstream fix: https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x ## Impact When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization. Applications that use Server Actions are affected when the incoming host header is not fixed to a trusted value. This typically occurs on custom servers,… ### Next.js: Next.js: Unauthenticated disclosure of internal Server Function endpoints - URL: https://www.hacktron.ai/security-changelog/nextjs#nextjs-ghsa-955p-x3mx-jcvp - Severity: medium - CVE: CVE-2026-64643 - Date: 2026-07-22 - Affected component: next - Affected versions: >= 13.0.0, < 15.5.21; >= 16.0.0, < 16.2.11 - Fixed versions: 15.5.21, 16.2.11 - Upstream fix: https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp ## Impact In Next.js applications using App Router, Server Actions (`use server`) or `use cache` endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used. Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts (for example, static chunks containing action references). Affected users are applications using App Router + Server Actions. By itself, this disclosure is typically a recon/enumeration primitive; however, it c… ### Next.js: Next.js: Unbounded Server Action payload in Edge runtime - URL: https://www.hacktron.ai/security-changelog/nextjs#nextjs-ghsa-4c39-4ccg-62r3 - Severity: medium - CVE: CVE-2026-64646 - Date: 2026-07-22 - Affected component: next - Affected versions: >= 13.0.0, < 15.5.21; >= 16.0.0, < 16.2.11 - Fixed versions: 15.5.21, 16.2.11 - Upstream fix: https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3 ## Impact Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime ## Workarounds If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be allowed at max by your hosting provider. ### Astro: Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch - URL: https://www.hacktron.ai/security-changelog/astro#astro-ghsa-vj59-8hwv-xxmv - Severity: high - CVE: CVE-2026-59731 - Date: 2026-07-20 - Affected component: astro - Affected versions: >= 6.4.7, < 6.4.8 - Fixed versions: 6.4.8 - Upstream fix: https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv # Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch ## Summary Astro 6.4.7 appears to reintroduce a middleware authorization bypass pattern when a request path is encoded more deeply than the newly introduced iterative URL decoder's maximum decoding depth. The issue occurs because Astro performs authorization decisions on a partially decoded pathname after reaching a decoding iteration cap, while later route matching logic performs an additional `decodeURI()`… ### Astro: Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered - URL: https://www.hacktron.ai/security-changelog/astro#astro-ghsa-8mv7-9c27-98vc - Severity: medium - CVE: CVE-2026-73423 - Date: 2026-07-20 - Affected component: astro - Affected versions: >= 7.0.0, < 7.0.6 - Fixed versions: 7.0.6 - Upstream fix: https://github.com/withastro/astro/security/advisories/GHSA-8mv7-9c27-98vc ## Summary In the composable `astro/hono` pipeline, the `security.checkOrigin` protection is only installed by the `middleware()` primitive. The `actions()` and `pages()` primitives each dispatch to user code independently, so a pipeline that mounts either primitive before (or without) `middleware()` will bypass the origin check for those requests. ## Details `security.checkOrigin` (default: `true`) is intended to reject cross-site `POST`/`PUT`/`PATCH`/`DELETE` form submissions. In the classic pipeline (`astro(… ### Astro: Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands - URL: https://www.hacktron.ai/security-changelog/astro#astro-ghsa-7pw4-f3q4-r2p2 - Severity: low - CVE: CVE-2026-59727 - Date: 2026-07-20 - Affected component: astro - Affected versions: >= 3.10.0, < 7.0.4 - Fixed versions: 7.0.4 - Upstream fix: https://github.com/withastro/astro/security/advisories/GHSA-7pw4-f3q4-r2p2 ### Summary When a `transition:persist`, `transition:scope`, or `transition:persist-props` directive is applied to a client-hydrated (`client:*`) component, Astro copied the directive value onto the rendered `` element **without HTML-escaping it**. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting (XSS). ### Severi… ### Astro: Astro: Reflected XSS via unescaped View Transition animation properties - URL: https://www.hacktron.ai/security-changelog/astro#astro-ghsa-4g3v-8h47-v7g6 - Severity: medium - CVE: CVE-2026-73422 - Date: 2026-07-20 - Affected component: astro - Affected versions: >= 2.9.0, <= 7.0.9 - Fixed versions: 7.1.0 - Upstream fix: https://github.com/withastro/astro/security/advisories/GHSA-4g3v-8h47-v7g6 ## Summary Astro's server-side View Transition CSS generator interpolates animation properties into an inline `` sequence, terminate the generated style element, and inject arbitrary HTML or JavaScript. This is similar to GHSA-8hv8-536x-4wqp, but exploits a different injection point: unescaped View Transition animation values in a server-gen… ### Astro: Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298) - URL: https://www.hacktron.ai/security-changelog/astro#astro-ghsa-f48w-9m4c-m7f5 - Severity: medium - CVE: CVE-2026-59729 - Date: 2026-07-20 - Affected component: astro - Affected versions: < 7.0.6 - Fixed versions: 7.0.6 - Upstream fix: https://github.com/withastro/astro/security/advisories/GHSA-f48w-9m4c-m7f5 ## Summary The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an `INVALID_ATTR_NAME_CHAR` guard to `addAttribute()` so that spread-prop attribute names containing `"' >/=` or whitespace are dropped. A second attribute-rendering path, `renderHTMLElement()` in `packages/astro/src/runtime/server/render/dom.ts`, has its own inline attribute loop that does not go through `addAttribute()` and was not updated. It interpolates the attribute name unescaped and only escapes the value, so untrusted prop keys spread onto… ### Astro: Astro: Host header SSRF in prerendered error page fetch - URL: https://www.hacktron.ai/security-changelog/astro#astro-ghsa-2pvr-wf23-7pc7 - Severity: high - CVE: CVE-2026-54299 - Date: 2026-06-16 - Affected component: astro - Affected versions: < 6.4.6 - Fixed versions: 6.4.6 - Upstream fix: https://github.com/withastro/astro/security/advisories/GHSA-2pvr-wf23-7pc7 ## Summary Astro SSR apps with prerendered error pages (`/404` or `/500` using `export const prerender = true`) fetch those pages over HTTP at runtime when an error occurs. The URL for this fetch is derived from `request.url`, which in turn gets its origin from the incoming `Host` header. When the `Host` header is not validated against `allowedDomains`, an attacker can point the fetch at an arbitrary host and read the response. ## Who is affected This affects SSR deployments that: 1. Have a prerendered 404 or… ### Astro: Astro: Reflected XSS via unescaped slot name - URL: https://www.hacktron.ai/security-changelog/astro#astro-ghsa-8hv8-536x-4wqp - Severity: high - CVE: CVE-2026-50146 - Date: 2026-06-16 - Affected component: astro - Affected versions: < 6.3.3 - Fixed versions: 6.3.3 - Upstream fix: https://github.com/withastro/astro/security/advisories/GHSA-8hv8-536x-4wqp ## Summary When a component uses a `client:*` directive, Astro inserts named slot content into a `data-astro-template` attribute without HTML escaping the slot name allowing an attacker to break out of the attribute context and inject arbitrary HTML, resulting in reflected XSS during SSR. This is similar to GHSA-wrwg-2hg8-v723 but exploits a different injection point. ## Vulnerable Code `packages/astro/src/runtime/server/render/component.ts:371:376` ```ts // component.ts:371 `