Skip to content

Fix: Server-side template injection: GET /profile passes the user-controlled username to eval(), enabling remote code execution - #363

Closed
WesternConcrete wants to merge 1 commit into
developfrom
devin/1789283345-profile-ssti-eval-develop
Closed

Fix: Server-side template injection: GET /profile passes the user-controlled username to eval(), enabling remote code execution#363
WesternConcrete wants to merge 1 commit into
developfrom
devin/1789283345-profile-ssti-eval-develop

Fix: remove eval() of user-controlled username in GET /profile (SSTI/…

3c3cd40
Select commit
Loading
Failed to load commit list.

Select a check to view from the sidebar