forked from snyk-labs/nodejs-goof
-
Notifications
You must be signed in to change notification settings - Fork 3
Pull requests: COG-GTM/nodejs-goof
Author
Label
Projects
Milestones
Reviews
Assignee
Sort
Pull requests list
bug: fix reflected XSS in admin login via unescaped redirectPage
#166
opened Aug 12, 2026 by
devin-ai-integration
Bot
Loading…
bug: fix prototype pollution in PUT /chat and externalize chat credentials
#165
opened Aug 11, 2026 by
devin-ai-integration
Bot
Loading…
bug: fix unauthenticated OS command injection in POST /create (AVID-54E1895E)
#164
opened Aug 11, 2026 by
devin-ai-integration
Bot
Loading…
bug: load express-session secret from env and harden session cookie flags
#162
opened Aug 11, 2026 by
devin-ai-integration
Bot
Loading…
fix: prevent Zip Slip path traversal in POST /import (AVID-3168A1DC)
#163
opened Aug 11, 2026 by
devin-ai-integration
Bot
Loading…
bug: fix stored XSS in todo markdown rendering (AVID-6BE09A50)
#161
opened Aug 11, 2026 by
devin-ai-integration
Bot
Loading…
bug: fix Dust SSTI via device query param on GET /about_new
#160
opened Aug 11, 2026 by
devin-ai-integration
Bot
Loading…
bug: remove hard-coded admin seed credentials (AVID-4F626210)
#159
opened Aug 11, 2026 by
devin-ai-integration
Bot
Loading…
fix: prevent Zip Slip path traversal in /import extraction
#158
opened Aug 11, 2026 by
devin-ai-integration
Bot
Loading…
bug: sanitize todo markdown rendering to fix stored XSS
#157
opened Aug 11, 2026 by
devin-ai-integration
Bot
Loading…
bug: remove hard-coded admin seed credentials, hash stored passwords
#156
opened Aug 11, 2026 by
devin-ai-integration
Bot
Loading…
bug: fix prototype pollution via lodash.merge in PUT /chat
#155
opened Aug 11, 2026 by
devin-ai-integration
Bot
Loading…
fix: prevent SSTI via device query param on /about_new
#154
opened Aug 11, 2026 by
devin-ai-integration
Bot
Loading…
fix: reject non-string credentials in loginHandler (NoSQL operator injection)
#153
opened Aug 11, 2026 by
devin-ai-integration
Bot
Loading…
bug: fix prototype pollution in [email protected] (SNYK-JS-HANDLEBARS-534988)
#152
opened Aug 11, 2026 by
devin-ai-integration
Bot
Loading…
bug: upgrade adm-zip 0.4.7 -> 0.4.11 (npm:adm-zip:20180415, CVE-2018-1002204 Zip Slip)
#151
opened Aug 11, 2026 by
devin-ai-integration
Bot
Loading…
bug: fix SNYK-DEBIAN11-AOM-7197980 (CVE-2024-5171) by moving base image to node:18.20.8-bookworm
#150
opened Aug 11, 2026 by
devin-ai-integration
Bot
Loading…
bug: fix SNYK-DEBIAN11-EXPAT-7855504 (CVE-2024-45491) by moving the Docker base image to Debian 12
#149
opened Aug 11, 2026 by
devin-ai-integration
Bot
Loading…
bug: fix SNYK-DEBIAN11-AOM-1300249 (CVE-2021-30475) by moving base image to node:18.20.8-bookworm
#148
opened Aug 11, 2026 by
devin-ai-integration
Bot
Loading…
bug: fix SNYK-DEBIAN11-AOM-1290331 (CVE-2021-30473) by moving the Docker base image to node:18.20.8-bookworm
#147
opened Aug 11, 2026 by
devin-ai-integration
Bot
Loading…
bug: fix prototype pollution in chat handler enabling authz bypass
#146
opened Aug 11, 2026 by
devin-ai-integration
Bot
Loading…
bug: fix unauthenticated OS command injection in POST /create
#145
opened Aug 11, 2026 by
devin-ai-integration
Bot
Loading…
bug: fix reflected XSS via redirectPage on GET /login
#144
opened Aug 11, 2026 by
devin-ai-integration
Bot
Loading…
fix: [lodash] Upgrade lodash from 4.17.4 to 4.17.21 to resolve CVE-2021-23337
#143
opened Aug 10, 2026 by
hannahhuh-cog
Loading…
fix: [sha.js] Upgrade sha.js from 2.4.11 to 2.4.12 to resolve CVE-2025-9288
#142
opened Aug 10, 2026 by
hannahhuh-cog
Loading…
Previous Next
ProTip!
Find all pull requests that aren't related to any open issues with -linked:issue.