ezo labs security

422 pull requests on record, all upstream report a vulnerability security@ezolabs.io

privately reported findings

private EZO reports on upstream advisories, published or still in triage, and the artifacts we measured.

  1. 3xpyth0n/ideon private advisory in triage

    filed 2026-11-13; not published, so no advisory link, fix or detail is listed until the maintainer publishes it.

  2. canonical/lxd private advisories in triage

    2 advisories filed 2026-11-13 to 2026-11-13; not published, so no advisory link, fix or detail is listed until the maintainer publishes them.

  3. langgenius/dify private advisory in triage

    filed 2026-11-13; not published, so no advisory link, fix or detail is listed until the maintainer publishes it.

  4. christianhelle/refitter server-side request forgery awaiting maintainer triage

    upstream GHSA-4f49-pm8q-mx4f; advisory published ; fixed 2.4.0.

  5. modelcontextprotocol/csharp-sdk private advisory in triage

    filed 2026-11-12; not published, so no advisory link, fix or detail is listed until the maintainer publishes it.

  6. milvus-io/milvus private advisories in triage

    3 advisories filed 2026-11-12 to 2026-11-12; not published, so no advisory link, fix or detail is listed until the maintainer publishes them.

  7. facebookresearch/faiss private advisories in triage

    5 advisories filed 2026-11-12 to 2026-11-12; not published, so no advisory link, fix or detail is listed until the maintainer publishes them.

  8. lancedb/lancedb private advisory in triage

    filed 2026-11-12; not published, so no advisory link, fix or detail is listed until the maintainer publishes it.

  9. ZJONSSON/node-unzipper private advisory in triage

    filed 2026-11-12; not published, so no advisory link, fix or detail is listed until the maintainer publishes it.

  10. windmill-labs/windmill private advisory in triage

    filed 2026-11-12; not published, so no advisory link, fix or detail is listed until the maintainer publishes it.

  11. MervinPraison/PraisonAI private advisories in triage

    3 advisories filed 2026-11-12 to 2026-11-13; not published, so no advisory link, fix or detail is listed until the maintainer publishes them.

  12. kubernetes-sigs/aws-load-balancer-controller private advisory in triage

    filed 2026-11-10; not published, so no advisory link, fix or detail is listed until the maintainer publishes it.

  13. starman69/mcp-sanitizer private advisory in triage

    filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it.

  14. LibreChat-AI/LibreChat private advisory in triage

    filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it.

  15. cortezaproject/corteza private advisory in triage

    filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it.

  16. omnara-ai/omnara private advisory in triage

    filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it.

  17. surrealdb/surrealdb private advisory in triage

    filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it.

  18. better-auth/better-auth private advisory in triage

    filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it.

  19. trailofbits/fickling private advisory in triage

    filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it.

  20. mmaitre314/picklescan private advisory in triage

    2 advisories filed 2026-11-09 to 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it.

  21. http4k/http4k private advisory in triage

    filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it.

  22. siyuan-note/siyuan private advisory in triage

    filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it.

  23. lowdefy/lowdefy private advisory in triage

    filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it.

  24. bitcoinj/bitcoinj private advisory in triage

    filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it.

  25. J-F-Liu/lopdf stack overflow awaiting maintainer triage

    upstream GHSA-4597-5x94-x3xg; advisory published ; the advisory names no fixed version.

  26. django-guardian/django-guardian private advisory in triage

    filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it.

  27. grokability/snipe-it private advisory in triage

    filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it.

  28. pydantic/pydantic-ai private advisory in triage

    filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it.

  29. axllent/mailpit private advisory in triage

    filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it.

  30. parse-community/parse-dashboard private advisory in triage

    filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it.

  31. open-webui/open-webui private advisory in triage

    filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it.

  32. directus/directus private advisories in triage

    2 advisories filed 2026-11-09 to 2026-11-12; not published, so no advisory link, fix or detail is listed until the maintainer publishes them.

  33. chartbrew/chartbrew private advisories in triage

    5 advisories filed 2026-11-08 to 2026-11-13; not published, so no advisory link, fix or detail is listed until the maintainer publishes them.

  34. Budibase/budibase private advisory in triage

    filed 2026-11-08; not published, so no advisory link, fix or detail is listed until the maintainer publishes it.

  35. strands-agents/harness-sdk private advisories in triage

    3 advisories filed 2026-11-08; not published, so no advisory link, fix or detail is listed until the maintainer publishes them.

  36. modelcontextprotocol/servers private advisories in triage

    3 advisories filed 2026-11-07 to 2026-11-08; not published, so no advisory link, fix or detail is listed until the maintainer publishes them.

  37. intlify/vue-i18n private advisory in triage

    filed 2026-11-08; not published, so no advisory link, fix or detail is listed until the maintainer publishes it.

  38. highcharts/highcharts hardening note sent

    emailed to security@highsoft.com on 2026-11-08; no reply as of this build, so nothing is claimed about acknowledgement.

  39. modelcontextprotocol/typescript-sdk private advisory in triage

    filed 2026-11-03; not published, so no advisory link, fix or detail is listed until the maintainer publishes it.

  40. OpenHands/OpenHands command injection awaiting maintainer triage

    upstream GHSA-7h8w-hj9j-8rjw; advisory published ; fixed 1.5.0.

  41. lobehub/lobehub (LobeChat) path traversal leading to remote code execution awaiting maintainer triage

    upstream GHSA-2g9j-v25c-4j97; advisory published ; fixed 2.1.49.

  42. f/prompts.chat server-side request forgery awaiting maintainer triage

    upstream GHSA-cjq9-62q9-8jv4 / CVE-2026-94483; advisory published ; fixed next 16.3.8.

upstream dates and fixes describe the public advisories, not acknowledgement of our reports.

recent upstream pull requests

the five most recent pull requests EZO sent upstream against repositories we do not own, whether a response to a published dependency advisory, a fix for a defect EZO found and verified, or a maintenance update including registry listings and documentation; pull requests inside the organisations we belong to are not in the record. The record counts pull requests EZO sent upstream, opened or contributed to, not targets it ruled out: a repository that refuses automated pull requests, a target already fixed upstream, and a target a bot already has an open pull request for are excluded, and no new pull request is filed for them, so none of them moves the count.

  1. arodus/signalk-mcp#57 node-forge 1.4.0 to 1.4.3 open evidence: source-read
  2. lissy93/framework-benchmarks#54 @builder.io/qwik 1.15.0 to 1.20.4 open evidence: source-read
  3. plasma-umass/scalene#1126 vega-selections 5.6.0 to 5.6.3 open evidence: source-read
  4. chakra-ui/chakra-ui#11072 seroval 1.3.2 to 1.8.1 open evidence: source-read
  5. diceframe/diceframe#753 vite 8.1.4 to 8.1.6 merged evidence: source-read

    EZO's pull request merged into main at 368b756 on ; no release is named.

view the dependency remediation record

creation dates are when each pull request was opened, in utc.

states were checked at the last read of each row, the newest on 2026-11-13 15:37:00 utc; the newest state this record carries is 2026-11-13 14:05:55 utc.

evidence is the method used to show a finding, not its severity.

a CVE ID request for vinilana/jev-gateway#68 was filed with MITRE on 2026-11-03, ticket 2137133, and assignment is pending.

a CVE ID request for vpulim/node-soap#1541 was filed with MITRE on 2026-11-02, ticket 2137075, and assignment is pending.

upstream issues

the defects EZO filed upstream as issues rather than pull requests, where a decision belongs to the maintainer or the repository takes no unsolicited pull request. ten issues on record, counted apart from the pull requests.

  1. MervinPraison/PraisonAIUI#355 Private security report request: authentication issue in the dashboard. open evidence: source-read
  2. backstage/backstage#36730 Two advisories name a fixed version that does not contain the fix. closed (completed) evidence: source-read
  3. 0xJacky/nginx-ui#2103 Auto-backup tasks created before v2.4.3 with `:` in the name cannot be edited, and their old backup files are never pruned. closed (completed) evidence: executed
  4. medusajs/medusa#17715 create-medusa-app --plugin ignores --version and scaffolds a 2.19.0, peer-incompatible plugin. closed (completed) evidence: executed
  5. colinhacks/zod#6731 five examples in packages/docs/content/api.mdx and codecs.mdx are wrong against zod 4.6.7: a .catch() context whose error is not a ZodError, a when() example whose password fails before the refinement runs, a synchronous parse of an async transform, a timezone-dependent date literal, and a Zod Mini tab that throws; a patch for all five is at a gist. open evidence: executed
  6. salesforce/tough-cookie#673 published tough-cookie 6.0.2 drops SameSite=None when serialising a cookie, so the emitted Set-Cookie downgrades a cross-site cookie to the Lax default, and the #639 change has never shipped to npm. closed (completed) evidence: executed
  7. jshttp/cookie#291 parseSetCookie returns values its own stringifySetCookie rejects, and a CR or LF inside an attribute name silently drops Secure. A maintainer answered that this is working as intended, with the parser intended to be lenient and the serializer strict(er), and that the README could be updated instead; the issue closed as completed on 2026-11-03 21:16:58 utc. The divergence the issue names is real, and the documentation is the open item. closed (completed) evidence: executed
  8. ljharb/qs#643 README.md says at two places that decodeDotInKeys on parse or encodeDotInKeys on stringify together with an explicit allowDots: false is an error, but neither call errors: parse returns the dotted key intact and stringify returns a double-encoded %252E. The repository's own test named 'with allowDots false and encodeDotInKeys true' pins the non-throwing output, so the library behaviour is deliberate, and the README sentences arrived in the same commit that added the options and are still on main, so the documented error was never implemented. A second, unambiguous defect in the same paragraph: the stringify sentence names decodeDotInKeys, but the option stringify reads is encodeDotInKeys. The issue asks which side is intended rather than choosing, so the decision belongs to the maintainer. open evidence: executed
  9. yargs/yargs-parser#566 a bare -- after a short option is taken as that option's value, so parser(['-b', '--', 'x']) answers b: '--' and the end-of-options marker never reaches the main loop, while README.md documents the marker as ending the options; the long-option, array and narg paths do not consume it, and no pull request exists because CONTRIBUTING.md asks for one only by maintainer invitation. closed (completed) evidence: executed
  10. dexie/Dexie.js#2364 Table.upsert() returns the inverse of what the documentation says: the documentation says true means the object was created, while the table implementation returns !!existing, so the value is true when the object was updated; the repository's own tests assert the implementation's meaning, so the documentation is the outlier and the choice belongs to the maintainer. open evidence: executed

the full record, counted

pull requests opened upstream
422
2015-05-26 to 2026-11-13 utc
repositories
363
422 pull requests across 363 repositories
packages
97
node-forge, @builder.io/qwik, vega-selections, seroval, vite, @feathersjs/authentication-oauth, jsonata, openclaw, undici, next, body-parser, @modelcontextprotocol/sdk, maplibre-gl, handlebars, simple-git, lodash, @google/gemini-cli, electron, happy-dom, hono, @usebruno/cli, @vitest/browser, jspdf, russh, markdown-it, @angular/router, multer, aiohttp, pypdf, uv, better-auth, storybook, authlib, vm2, quasar, praisonai, @zereight/mcp-gitlab, n8n-mcp, suneditor, payload, @nyariv/sandboxjs, 9router, react-server-dom-webpack, @react-native-community/cli, @theia/core, n8n, shescape, orval, open, @wppconnect/server, dompurify, anyio, python-multipart, tinacms, @tinacms/cli, @backstage/plugin-scaffolder-backend, @a2ui/web_core, zod, @tanstack/react-start, @sentry/nextjs, @xmldom/xmldom, git-diff, signalk-server, fast-jwt, multiparty, decode-uri-component, @hapi/content, @fastify/busboy, brace-expansion, fast-uri, proxy-addr, xlsx, express, axios, follow-redirects, basic-ftp, moment, adm-zip, js-yaml, opentelemetry-api, pillow, gitpython, ddtrace, mcp, graphql-scalars, toml, ip-address, mistune, djangorestframework, enshrined/svg-sanitize, nodemailer, symfony/http-foundation, tornado, graphql-core, postal-mime, pydantic-ai, sharp
show allshow less
evidence methods
3
source-read, executed, artifact-measured

what runs

  • superbot security

    finds security issues and notifies the system owner.

  • always-on defense

    defensive agents for enterprise systems.

  • agent-to-agent defense

    defensive products for agent systems.

kernel work

a Linux kernel fix we check for, and the CVE we asked for it.

always-on agent defender

superbot agents that watch your systems around the clock.

talk to us

report a vulnerability

email us the steps to reproduce it.

security@ezolabs.io

we review reports, coordinate fixes, and credit researchers on request.

good-faith research in scope is welcome. we will not pursue researchers who stay in scope and give us time to fix it.

our ceo and security lead.