---
title: "security"
updated: "2026-11-13"
type: WebPage
---

# ezo labs security

422 pull requests on record, all in the [dependency remediation record](https://ezolabs.net/security-disclosures). report a vulnerability: [security@ezolabs.io](mailto:security@ezolabs.io).

## privately reported findings

private EZO reports on upstream advisories, published or still in triage, and the artifacts we measured.
| private report | project | finding class | status | upstream advisory, publication and fix |
| --- | --- | --- | --- | --- |
| 2026-11-13 | [3xpyth0n/ideon](https://github.com/3xpyth0n/ideon) | private advisory | in triage | filed 2026-11-13; not published, so no advisory link, fix or detail is listed until the maintainer publishes it. |
| 2026-11-13 | [canonical/lxd](https://github.com/canonical/lxd) | private advisories | in triage | 2 advisories filed 2026-11-13 to 2026-11-13; not published, so no advisory link, fix or detail is listed until the maintainer publishes them. |
| 2026-11-13 | [langgenius/dify](https://github.com/langgenius/dify) | private advisory | in triage | filed 2026-11-13; not published, so no advisory link, fix or detail is listed until the maintainer publishes it. |
| 2026-11-13 | [christianhelle/refitter](https://github.com/christianhelle/refitter) | server-side request forgery | awaiting maintainer triage | [GHSA-4f49-pm8q-mx4f](https://github.com/advisories/GHSA-4f49-pm8q-mx4f); published 2026-11-13; fixed 2.4.0 |
| 2026-11-12 | [modelcontextprotocol/csharp-sdk](https://github.com/modelcontextprotocol/csharp-sdk) | private advisory | in triage | filed 2026-11-12; not published, so no advisory link, fix or detail is listed until the maintainer publishes it. |
| 2026-11-12 | [milvus-io/milvus](https://github.com/milvus-io/milvus) | private advisories | in triage | 3 advisories filed 2026-11-12 to 2026-11-12; not published, so no advisory link, fix or detail is listed until the maintainer publishes them. |
| 2026-11-12 | [facebookresearch/faiss](https://github.com/facebookresearch/faiss) | private advisories | in triage | 5 advisories filed 2026-11-12 to 2026-11-12; not published, so no advisory link, fix or detail is listed until the maintainer publishes them. |
| 2026-11-12 | [lancedb/lancedb](https://github.com/lancedb/lancedb) | private advisory | in triage | filed 2026-11-12; not published, so no advisory link, fix or detail is listed until the maintainer publishes it. |
| 2026-11-12 | [ZJONSSON/node-unzipper](https://github.com/ZJONSSON/node-unzipper) | private advisory | in triage | filed 2026-11-12; not published, so no advisory link, fix or detail is listed until the maintainer publishes it. |
| 2026-11-12 | [windmill-labs/windmill](https://github.com/windmill-labs/windmill) | private advisory | in triage | filed 2026-11-12; not published, so no advisory link, fix or detail is listed until the maintainer publishes it. |
| 2026-11-12 | [MervinPraison/PraisonAI](https://github.com/MervinPraison/PraisonAI) | private advisories | in triage | 3 advisories filed 2026-11-12 to 2026-11-13; not published, so no advisory link, fix or detail is listed until the maintainer publishes them. |
| 2026-11-10 | [kubernetes-sigs/aws-load-balancer-controller](https://github.com/kubernetes-sigs/aws-load-balancer-controller) | private advisory | in triage | filed 2026-11-10; not published, so no advisory link, fix or detail is listed until the maintainer publishes it. |
| 2026-11-09 | [starman69/mcp-sanitizer](https://github.com/starman69/mcp-sanitizer) | private advisory | in triage | filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it. |
| 2026-11-09 | [LibreChat-AI/LibreChat](https://github.com/LibreChat-AI/LibreChat) | private advisory | in triage | filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it. |
| 2026-11-09 | [cortezaproject/corteza](https://github.com/cortezaproject/corteza) | private advisory | in triage | filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it. |
| 2026-11-09 | [omnara-ai/omnara](https://github.com/omnara-ai/omnara) | private advisory | in triage | filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it. |
| 2026-11-09 | [surrealdb/surrealdb](https://github.com/surrealdb/surrealdb) | private advisory | in triage | filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it. |
| 2026-11-09 | [better-auth/better-auth](https://github.com/better-auth/better-auth) | private advisory | in triage | filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it. |
| 2026-11-09 | [trailofbits/fickling](https://github.com/trailofbits/fickling) | private advisory | in triage | filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it. |
| 2026-11-09 | [mmaitre314/picklescan](https://github.com/mmaitre314/picklescan) | private advisory | in triage | 2 advisories filed 2026-11-09 to 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it. |
| 2026-11-09 | [http4k/http4k](https://github.com/http4k/http4k) | private advisory | in triage | filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it. |
| 2026-11-09 | [siyuan-note/siyuan](https://github.com/siyuan-note/siyuan) | private advisory | in triage | filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it. |
| 2026-11-09 | [lowdefy/lowdefy](https://github.com/lowdefy/lowdefy) | private advisory | in triage | filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it. |
| 2026-11-09 | [bitcoinj/bitcoinj](https://github.com/bitcoinj/bitcoinj) | private advisory | in triage | filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it. |
| 2026-11-09 | [J-F-Liu/lopdf](https://github.com/J-F-Liu/lopdf) | stack overflow | awaiting maintainer triage | [GHSA-4597-5x94-x3xg](https://github.com/advisories/GHSA-4597-5x94-x3xg); published 2026-11-12; the advisory names no fixed version |
| 2026-11-09 | [django-guardian/django-guardian](https://github.com/django-guardian/django-guardian) | private advisory | in triage | filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it |
| 2026-11-09 | [grokability/snipe-it](https://github.com/grokability/snipe-it) | private advisory | in triage | filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it |
| 2026-11-09 | [pydantic/pydantic-ai](https://github.com/pydantic/pydantic-ai) | private advisory | in triage | filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it |
| 2026-11-09 | [axllent/mailpit](https://github.com/axllent/mailpit) | private advisory | in triage | filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it |
| 2026-11-09 | [parse-community/parse-dashboard](https://github.com/parse-community/parse-dashboard) | private advisory | in triage | filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it |
| 2026-11-09 | [open-webui/open-webui](https://github.com/open-webui/open-webui) | private advisory | in triage | filed 2026-11-09; not published, so no advisory link, fix or detail is listed until the maintainer publishes it |
| 2026-11-09 | [directus/directus](https://github.com/directus/directus) | private advisories | in triage | 2 advisories filed 2026-11-09 to 2026-11-12; not published, so no advisory link, fix or detail is listed until the maintainer publishes them. |
| 2026-11-08 | [chartbrew/chartbrew](https://github.com/chartbrew/chartbrew) | private advisories | in triage | 5 advisories filed 2026-11-08 to 2026-11-13; not published, so no advisory link, fix or detail is listed until the maintainer publishes them. |
| 2026-11-08 | [Budibase/budibase](https://github.com/Budibase/budibase) | private advisory | in triage | filed 2026-11-08; not published, so no advisory link, fix or detail is listed until the maintainer publishes it |
| 2026-11-08 | [strands-agents/harness-sdk](https://github.com/strands-agents/harness-sdk) | private advisories | in triage | 3 advisories filed 2026-11-08; not published, so no advisory link, fix or detail is listed until the maintainer publishes them |
| 2026-11-08 | [modelcontextprotocol/servers](https://github.com/modelcontextprotocol/servers) | private advisories | in triage | 3 advisories filed 2026-11-07 to 2026-11-08; not published, so no advisory link, fix or detail is listed until the maintainer publishes them |
| 2026-11-08 | [intlify/vue-i18n](https://github.com/intlify/vue-i18n) | private advisory | in triage | filed 2026-11-08; not published, so no advisory link, fix or detail is listed until the maintainer publishes it |
| 2026-11-08 | [highcharts/highcharts](https://github.com/highcharts/highcharts) | hardening note | sent | emailed to security@highsoft.com on 2026-11-08; no reply as of this build, so nothing is claimed about acknowledgement |
| 2026-11-03 | [modelcontextprotocol/typescript-sdk](https://github.com/modelcontextprotocol/typescript-sdk) | private advisory | in triage | not published, so no advisory link, fix or detail is listed until the maintainer publishes it |
| 2026-10-26 | [OpenHands/OpenHands](https://github.com/OpenHands/OpenHands) | command injection | awaiting maintainer triage | [GHSA-7h8w-hj9j-8rjw](https://github.com/OpenHands/OpenHands/security/advisories/GHSA-7h8w-hj9j-8rjw); published 2026-03-23; fixed 1.5.0 |
| 2026-10-26 | [lobehub/lobehub (LobeChat)](https://github.com/lobehub/lobehub) | path traversal leading to remote code execution | awaiting maintainer triage | [GHSA-2g9j-v25c-4j97](https://github.com/lobehub/lobehub/security/advisories/GHSA-2g9j-v25c-4j97); published 2026-10-17; fixed 2.1.49 |
| 2026-10-26 | [f/prompts.chat](https://github.com/f/prompts.chat) | server-side request forgery | awaiting maintainer triage | [GHSA-cjq9-62q9-8jv4](https://github.com/advisories/GHSA-cjq9-62q9-8jv4) / [CVE-2026-94483](https://nvd.nist.gov/vuln/detail/CVE-2026-94483); advisory published 2026-10-07; fixed next 16.3.8 |

upstream dates and fixes describe the public advisories, not acknowledgement of our reports.

## recent upstream pull requests

the five most recent pull requests EZO sent upstream against repositories we do not own, whether a response to a published dependency advisory, a fix for a defect EZO found and verified, or a maintenance update including registry listings and documentation; pull requests inside the organisations we belong to are not in the record. The record counts pull requests EZO sent upstream, opened or contributed to, not targets it ruled out: a repository that refuses automated pull requests, a target already fixed upstream, and a target a bot already has an open pull request for are excluded, and no new pull request is filed for them, so none of them moves the count.

| opened (utc) | pull request | upgrade | state | evidence | resolution |
| --- | --- | --- | --- | --- | --- |
| 2026-11-13 15:30:41 | [arodus/signalk-mcp#57](https://github.com/arodus/signalk-mcp/pull/57) | node-forge 1.4.0 to 1.4.3 | open | source-read |  |
| 2026-11-13 15:20:13 | [lissy93/framework-benchmarks#54](https://github.com/lissy93/framework-benchmarks/pull/54) | @builder.io/qwik 1.15.0 to 1.20.4 | open | source-read |  |
| 2026-11-13 09:58:26 | [plasma-umass/scalene#1126](https://github.com/plasma-umass/scalene/pull/1126) | vega-selections 5.6.0 to 5.6.3 | open | source-read |  |
| 2026-11-12 21:13:15 | [chakra-ui/chakra-ui#11072](https://github.com/chakra-ui/chakra-ui/pull/11072) | seroval 1.3.2 to 1.8.1 | open | source-read |  |
| 2026-11-12 18:07:33 | [diceframe/diceframe#753](https://github.com/diceframe/diceframe/pull/753) | vite 8.1.4 to 8.1.6 | merged | source-read | EZO's pull request merged into main at [368b756](https://github.com/diceframe/diceframe/commit/368b756aac346d0775b645dfe53d4afe184372b3) on 2026-11-13 05:12:20 utc; no release is named. |

[view the dependency remediation record](https://ezolabs.net/security-disclosures)

creation dates are when each pull request was opened, in utc.

states were checked at the last read of each row, the newest on 2026-11-13 15:37:00 utc; the newest state this record carries is 2026-11-13 14:05:55 utc.

evidence is the method used to show a finding, not its severity.

a CVE ID request for vinilana/jev-gateway#68 was filed with MITRE on 2026-11-03, ticket 2137133, and assignment is pending.

a CVE ID request for vpulim/node-soap#1541 was filed with MITRE on 2026-11-02, ticket 2137075, and assignment is pending.
## upstream issues

the defects EZO filed upstream as issues rather than pull requests, where a decision belongs to the maintainer or the repository takes no unsolicited pull request. ten issues on record, counted apart from the pull requests.

| filed (utc) | issue | defect | state | evidence |
| --- | --- | --- | --- | --- |
| 2026-11-11 19:27:45 | [MervinPraison/PraisonAIUI#355](https://github.com/MervinPraison/PraisonAIUI/issues/355) | Private security report request: authentication issue in the dashboard. | open | source-read |
| 2026-11-09 12:35:27 | [backstage/backstage#36730](https://github.com/backstage/backstage/issues/36730) | Two advisories name a fixed version that does not contain the fix. | closed (completed) | source-read |
| 2026-11-09 09:47:00 | [0xJacky/nginx-ui#2103](https://github.com/0xJacky/nginx-ui/issues/2103) | Auto-backup tasks created before v2.4.3 with `:` in the name cannot be edited, and their old backup files are never pruned. | closed (completed) | executed |
| 2026-11-08 18:56:51 | [medusajs/medusa#17715](https://github.com/medusajs/medusa/issues/17715) | create-medusa-app --plugin ignores --version and scaffolds a 2.19.0, peer-incompatible plugin. | closed (completed) | executed |
| 2026-11-04 18:58:57 | [colinhacks/zod#6731](https://github.com/colinhacks/zod/issues/6731) | five examples in packages/docs/content/api.mdx and codecs.mdx are wrong against zod 4.6.7: a .catch() context whose error is not a ZodError, a when() example whose password fails before the refinement runs, a synchronous parse of an async transform, a timezone-dependent date literal, and a Zod Mini tab that throws; a patch for all five is at a gist. | open | executed |
| 2026-11-03 21:08:00 | [salesforce/tough-cookie#673](https://github.com/salesforce/tough-cookie/issues/673) | published tough-cookie 6.0.2 drops SameSite=None when serialising a cookie, so the emitted Set-Cookie downgrades a cross-site cookie to the Lax default, and the #639 change has never shipped to npm. | closed (completed) | executed |
| 2026-11-03 21:00:00 | [jshttp/cookie#291](https://github.com/jshttp/cookie/issues/291) | parseSetCookie returns values its own stringifySetCookie rejects, and a CR or LF inside an attribute name silently drops Secure. A maintainer answered that this is working as intended, with the parser intended to be lenient and the serializer strict(er), and that the README could be updated instead; the issue closed as completed on 2026-11-03 21:16:58 utc. The divergence the issue names is real, and the documentation is the open item. | closed (completed) | executed |
| 2026-11-03 15:04:22 | [ljharb/qs#643](https://github.com/ljharb/qs/issues/643) | README.md says at two places that decodeDotInKeys on parse or encodeDotInKeys on stringify together with an explicit allowDots: false is an error, but neither call errors: parse returns the dotted key intact and stringify returns a double-encoded %252E. The repository's own test named 'with allowDots false and encodeDotInKeys true' pins the non-throwing output, so the library behaviour is deliberate, and the README sentences arrived in the same commit that added the options and are still on main, so the documented error was never implemented. A second, unambiguous defect in the same paragraph: the stringify sentence names decodeDotInKeys, but the option stringify reads is encodeDotInKeys. The issue asks which side is intended rather than choosing, so the decision belongs to the maintainer. | open | executed |
| 2026-11-03 14:33:54 | [yargs/yargs-parser#566](https://github.com/yargs/yargs-parser/issues/566) | a bare -- after a short option is taken as that option's value, so parser(['-b', '--', 'x']) answers b: '--' and the end-of-options marker never reaches the main loop, while README.md documents the marker as ending the options; the long-option, array and narg paths do not consume it, and no pull request exists because CONTRIBUTING.md asks for one only by maintainer invitation. | closed (completed) | executed |
| 2026-11-03 13:40:27 | [dexie/Dexie.js#2364](https://github.com/dexie/Dexie.js/issues/2364) | Table.upsert() returns the inverse of what the documentation says: the documentation says true means the object was created, while the table implementation returns !!existing, so the value is true when the object was updated; the repository's own tests assert the implementation's meaning, so the documentation is the outlier and the choice belongs to the maintainer. | open | executed |
## the full record, counted

- pull requests opened upstream: 422 (2015-05-26 to 2026-11-13 utc)
- repositories: 363 (422 pull requests across 363 repositories)
- packages: 97 (node-forge, @builder.io/qwik, vega-selections, seroval, vite, @feathersjs/authentication-oauth, jsonata, openclaw, undici, next, body-parser, @modelcontextprotocol/sdk, maplibre-gl, handlebars, simple-git, lodash, @google/gemini-cli, electron, happy-dom, hono, @usebruno/cli, @vitest/browser, jspdf, russh, markdown-it, @angular/router, multer, aiohttp, pypdf, uv, better-auth, storybook, authlib, vm2, quasar, praisonai, @zereight/mcp-gitlab, n8n-mcp, suneditor, payload, @nyariv/sandboxjs, 9router, react-server-dom-webpack, @react-native-community/cli, @theia/core, n8n, shescape, orval, open, @wppconnect/server, dompurify, anyio, python-multipart, tinacms, @tinacms/cli, @backstage/plugin-scaffolder-backend, @a2ui/web_core, zod, @tanstack/react-start, @sentry/nextjs, @xmldom/xmldom, git-diff, signalk-server, fast-jwt, multiparty, decode-uri-component, @hapi/content, @fastify/busboy, brace-expansion, fast-uri, proxy-addr, xlsx, express, axios, follow-redirects, basic-ftp, moment, adm-zip, js-yaml, opentelemetry-api, pillow, gitpython, ddtrace, mcp, graphql-scalars, toml, ip-address, mistune, djangorestframework, enshrined/svg-sanitize, nodemailer, symfony/http-foundation, tornado, graphql-core, postal-mime, pydantic-ai, sharp)
- evidence methods: 3 (source-read, executed, artifact-measured)
## what runs

- **superbot security**: finds security issues and notifies the system owner.
- **always-on defense**: defensive agents for enterprise systems.
- **agent-to-agent defense**: defensive products for agent systems.

## kernel work

a Linux kernel fix we check for, and the CVE we asked for it.

- **[reqsk-uaf-check](https://github.com/ezolabs/reqsk-uaf-check)**: a read-only, MIT-licensed checker we maintain and publish for a request-socket use-after-free fixed upstream by 97c8a3c1f73d. it answers VULNERABLE, PATCHED or UNDETERMINED from the compiled instruction at the deciding call site, never from the version string. it is a tool, not a service.
- **CVE-2026-99270**: we asked cve@kernel.org on 2026-11-01 for an id against "tcp: Fix potential UAF in reqsk_timer_handler()", the fix by Kuniyuki Iwashima, reported by Damiano Melotti. the fix is in v7.1 and in neither v7.0 nor any 6.x series. the Linux kernel CNA assigned CVE-2026-99270 on 2026-11-03.

## always-on agent defender

superbot agents that watch your systems around the clock. [talk to us](mailto:contact@ezolabs.net?subject=always-on%20agent%20defender)

## report a vulnerability

email us the steps to reproduce it: [security@ezolabs.io](mailto:security@ezolabs.io)

we review reports, coordinate fixes, and credit researchers on request.

good-faith research in scope is welcome. we will not pursue researchers who stay in scope and give us time to fix it.

our ceo and security lead.