Security: aehrc/pathling
Security
No security policy detected
This project has not set up a SECURITY.md file yet.
Report a vulnerability-
$import-pnp operation enables authenticated SSRF, credential leakage, and warehouse data poisoningGHSA-69wc-hrxh-5528 published
May 21, 2026 by johngrimesHigh -
Typed CRUD/search/batch providers can lead to server-wide PHI exfiltration and cross-resource mutationGHSA-q62q-2m46-r7rv published
May 21, 2026 by johngrimesHigh -
Pathling $bulk-submit allows bearer-token exfiltration and persistent warehouse poisoning via unvalidated manifest output URLsGHSA-26hp-x47g-x95q published
May 21, 2026 by johngrimesHigh -
Explicit oauthMetadataUrl in bulk-submit allows OAuth client credential exfiltrationGHSA-245h-c573-9vr5 published
May 21, 2026 by johngrimesHigh -
Path traversal in $result endpoint allows arbitrary warehouse file readGHSA-8w85-f63v-3wh6 published
May 21, 2026 by johngrimesHigh -
Path traversal in $import-pnp manifest enables read-capable SSRF via /jobs/{jobId}/{filename}GHSA-5h9r-m7r5-8jxq published
May 21, 2026 by johngrimesHigh
Learn more about advisories related to aehrc/pathling in the GitHub Advisory Database