All issues

Search results

[Security]: SessionControl list enumerates sessions in any workspace without caller-ownership check

Status: Open.

#2606 In GCWing/BitFun;

· 1688mengdie opened on Aug 28, 2026

[Security]: session JSON artifacts are written world-readable on unix (0o644 default umask)

Status: Open.

#2605 In GCWing/BitFun;

· 1688mengdie opened on Aug 28, 2026

[Security]: SessionHistory tool allows cross-session transcript export without authorization

Status: Open.

#2604 In GCWing/BitFun;

· 1688mengdie opened on Aug 28, 2026

[Security]: generative widget accepts postMessage updates from any window (HTML injection via forged bitfun-widget:update)

Status: Open.

#2603 In GCWing/BitFun;

· 1688mengdie opened on Aug 28, 2026

[Security]: mermaid SVG output is injected into HTML without sanitization (XSS via label HTML in loose mode)

Status: Open.

#2602 In GCWing/BitFun;

· 1688mengdie opened on Aug 28, 2026

[Security]: RUSTSEC-2026-0253: lru 0.12.5 in Cargo.lock is unsound (use-after-free via LruCache eviction)

Status: Open.

#2587 In GCWing/BitFun;

· 1688mengdie opened on Aug 28, 2026

[Security]: RUSTSEC-2026-0187: lopdf 0.41.0 in Cargo.lock (stack overflow via deeply nested PDF objects)

Status: Open.

#2586 In GCWing/BitFun;

· 1688mengdie opened on Aug 28, 2026

[Bug]: stale allow(unused_mut) on the main window builder hides future regressions

Status: Open.

#2582 In GCWing/BitFun;

· 1688mengdie opened on Aug 27, 2026

[Bug]: unused_mut warning for the browser webview builder in release builds

Status: Open.

#2581 In GCWing/BitFun;

· 1688mengdie opened on Aug 27, 2026

[Bug]: dead_code/unused_imports warnings for unix-only CLI dispatch and daemon symbols on Windows builds

Status: Open.

#2579 In GCWing/BitFun;

· 1688mengdie opened on Aug 27, 2026

[Bug]: cargo metadata compatibility warning repeated in every CI metadata validation step

Status: Open.

#2571 In GCWing/BitFun;

· 1688mengdie opened on Aug 27, 2026

[Bug]: dead_code warning for fork_session_for_plugin in feature-less core test builds

Status: Open.

#2570 In GCWing/BitFun;

· 1688mengdie opened on Aug 27, 2026