Advisory Catalog

Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled

Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies

urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory

urllib3: Chunked Deflate streaming can enter an infinite loop

urllib3: HTTPS proxy TLS configuration may be ignored or overridden

Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

Werkzeug safe_join() allows Windows special device names

Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. The SQL API endpoint is built as `https://{account}.snowflakecomputing.com/api/v2/statements`, so an `account` value containing `/`, `?` or `#` demotes the

Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended clau