-
Notifications
You must be signed in to change notification settings - Fork 12
All issues
Issue creation is restricted in this repository
Issues
is:issue state:open
is:issue state:open
Search results
[SECURITY][MEDIUM] 12 vulnerable build/dev dependencies — vite path bypass, postcss XSS, serve used in production
bugSomething isn't workingSomething isn't workingready-for-devHuman-triaged — safe for autonomous agent pickupHuman-triaged — safe for autonomous agent pickupsecuritySecurity vulnerabilitySecurity vulnerabilitytriagedIssue has been reviewed and categorisedIssue has been reviewed and categorisedStatus: Open.#83 In Eyevinn/open-live-studio;[SECURITY][HIGH] react-router 7.14.0 has multiple CVEs — open redirect (CVE-2026-40181), CSRF, DoS, and RCE deserialization
bugSomething isn't workingSomething isn't workinggood-first-issueWell-scoped, beginner-friendlyWell-scoped, beginner-friendlyready-for-devHuman-triaged — safe for autonomous agent pickupHuman-triaged — safe for autonomous agent pickupsecuritySecurity vulnerabilitySecurity vulnerabilitytriagedIssue has been reviewed and categorisedIssue has been reviewed and categorisedStatus: Open.#82 In Eyevinn/open-live-studio;[SECURITY][LOW] CSP missing media-src and frame-src directives — incomplete content restriction policy
bugSomething isn't workingSomething isn't workingsecuritySecurity vulnerabilitySecurity vulnerabilitytriagedIssue has been reviewed and categorisedIssue has been reviewed and categorisedStatus: Open.#57 In Eyevinn/open-live-studio;[SECURITY][LOW] vite.config.ts does not explicitly disable source maps — full TypeScript source exposed if Vite default changes
bugSomething isn't workingSomething isn't workingsecuritySecurity vulnerabilitySecurity vulnerabilitytriagedIssue has been reviewed and categorisedIssue has been reviewed and categorisedStatus: Open.#56 In Eyevinn/open-live-studio;[SECURITY][MEDIUM] Missing Permissions-Policy header — microphone and HID permissions not scoped to same-origin
bugSomething isn't workingSomething isn't workingsecuritySecurity vulnerabilitySecurity vulnerabilitytriagedIssue has been reviewed and categorisedIssue has been reviewed and categorisedStatus: Open.#55 In Eyevinn/open-live-studio;[SECURITY][MEDIUM] data:image/svg+xml accepted as graphic URL — SVG with embedded scripts exploitable via object/embed elements
bugSomething isn't workingSomething isn't workingsecuritySecurity vulnerabilitySecurity vulnerabilitytriagedIssue has been reviewed and categorisedIssue has been reviewed and categorisedStatus: Open.#54 In Eyevinn/open-live-studio;[SECURITY][MEDIUM] API path parameters not URL-encoded — path traversal risk if resource IDs contain special characters
bugSomething isn't workingSomething isn't workingsecuritySecurity vulnerabilitySecurity vulnerabilitytriagedIssue has been reviewed and categorisedIssue has been reviewed and categorisedStatus: Open.#53 In Eyevinn/open-live-studio;[SECURITY][LOW] Unvalidated 'pane' and 'productionId' URL parameters reach WebSocket routing logic
bugSomething isn't workingSomething isn't workinggood-first-issueWell-scoped, beginner-friendlyWell-scoped, beginner-friendlyready-for-devHuman-triaged — safe for autonomous agent pickupHuman-triaged — safe for autonomous agent pickupsecuritySecurity vulnerabilitySecurity vulnerabilitytriagedIssue has been reviewed and categorisedIssue has been reviewed and categorisedStatus: Open.#44 In Eyevinn/open-live-studio;[SECURITY][MEDIUM] 'pnpm start' (serve package) serves app without any security headers
bugSomething isn't workingSomething isn't workinggood-first-issueWell-scoped, beginner-friendlyWell-scoped, beginner-friendlyready-for-devHuman-triaged — safe for autonomous agent pickupHuman-triaged — safe for autonomous agent pickupsecuritySecurity vulnerabilitySecurity vulnerabilitytriagedIssue has been reviewed and categorisedIssue has been reviewed and categorisedStatus: Open.#42 In Eyevinn/open-live-studio;[SECURITY][MEDIUM] OSC_PAT baked into JS bundle if present in shell environment at vite build time
bugSomething isn't workingSomething isn't workinggood-first-issueWell-scoped, beginner-friendlyWell-scoped, beginner-friendlyready-for-devHuman-triaged — safe for autonomous agent pickupHuman-triaged — safe for autonomous agent pickupsecuritySecurity vulnerabilitySecurity vulnerabilitytriagedIssue has been reviewed and categorisedIssue has been reviewed and categorisedStatus: Open.#43 In Eyevinn/open-live-studio;[SECURITY][MEDIUM] isValidGraphicUrl() accepts data:text/html URIs — stored XSS via DSK overlay URL
bugSomething isn't workingSomething isn't workinggood-first-issueWell-scoped, beginner-friendlyWell-scoped, beginner-friendlyready-for-devHuman-triaged — safe for autonomous agent pickupHuman-triaged — safe for autonomous agent pickupsecuritySecurity vulnerabilitySecurity vulnerabilitytriagedIssue has been reviewed and categorisedIssue has been reviewed and categorisedStatus: Open.#41 In Eyevinn/open-live-studio;[SECURITY][MEDIUM] CSP connect-src uses bare 'wss:' wildcard — allows exfiltration to any WebSocket host
bugSomething isn't workingSomething isn't workingready-for-devHuman-triaged — safe for autonomous agent pickupHuman-triaged — safe for autonomous agent pickupsecuritySecurity vulnerabilitySecurity vulnerabilitytriagedIssue has been reviewed and categorisedIssue has been reviewed and categorisedStatus: Open.#40 In Eyevinn/open-live-studio;