All issues

Search results

yaml.FullLoader used instead of SafeLoader in pack metadata parsing (CWE-502)

Status: Open.

#6393 In StackStorm/st2;

· jaredbischof opened on Jul 20, 2026

Git worktree directories created with chmod 777 (CWE-732)

Status: Open.

#6392 In StackStorm/st2;

· jaredbischof opened on Jul 20, 2026

Predictable temp directory paths in pack management enable symlink attacks (CWE-377)

Status: Open.

#6391 In StackStorm/st2;

· jaredbischof opened on Jul 20, 2026

CORS middleware reflects Origin with Allow-Credentials, enabling cross-origin attacks (CWE-346)

Status: Open.

#6390 In StackStorm/st2;

· jaredbischof opened on Jul 20, 2026

HTTP runner defaults to verify=False, disabling TLS certificate validation (CWE-295)

Status: Open.

#6389 In StackStorm/st2;

· jaredbischof opened on Jul 20, 2026

Jinja2 auto-escape disabled in spec_loader (CWE-79)

Status: Open.

#6388 In StackStorm/st2;

· jaredbischof opened on Jul 20, 2026

Regular Expression Denial of Service (ReDoS) in check_processes action (CWE-400)

Status: Open.

#6387 In StackStorm/st2;

· jaredbischof opened on Jul 20, 2026

SSH host key verification disabled in paramiko runner (CWE-295)

Status: Open.

#6386 In StackStorm/st2;

· jaredbischof opened on Jul 20, 2026

Command Injection via unsanitized input in subprocess calls (CWE-78)

Status: Open.

#6385 In StackStorm/st2;

· jaredbischof opened on Jul 20, 2026

[TEN-87733] AMQP Cleartext Authentication — "The remote Advanced Message Queuing Protocol (AMQP) service supports one or more authentication mechanisms that allow credentials to be sent in clear text"

Status: Open.

#6383 In StackStorm/st2;

· nandinisingh-1901 opened on Jul 7, 2026

API key creation allows a non-admin to bind a key to any user and gain that user's privileges (privilege escalation to admin)

Status: Open.

#6380 In StackStorm/st2;

· geo-chen opened on Jun 20, 2026

Execution User Impersonation Allows Cross-Account KV Secret Exfiltration (All Versions Including 3.9.0)

Status: Open.

#6379 In StackStorm/st2;

· geo-chen opened on Jun 20, 2026