Contribution Checker
/gelhaus-solutions/public/contributor-check
Published advisories
Atom feedGSSA-2026-05-442ENFMay 7, 2026CRLF injection in email subject via project name
Project name was interpolated into outbound email subjects without rejecting CR/LF, so an admin could inject extra headers (Bcc, etc.) via the project settings form. Fixed by rejecting line breaks in the project name validator.
LowGSSA-2026-05-P6SB4WMay 7, 2026Missing browser security response headers
The dashboard shipped without CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, or HSTS, leaving it exposed to clickjacking, MIME-sniffing, and missing the standard defense-in-depth layer against same-origin XSS. Fixed by adding the standard security header set in next.config.ts.
MediumGSSA-2026-05-J0ZPKKMay 6, 2026Unbounded request body on webhook and CI endpoints
The GitHub webhook and CI check-pr API routes read the full request body before any validation. Anyone able to reach the endpoints could post a multi-GB body and exhaust process memory. Fixed by adding a streaming size cap (1MB and 2MB respectively) that returns 413 before signature or JWT verification.
HighGSSA-2026-05-A5DE8WMay 4, 2026SSRF in outbound project webhook delivery
A project admin could register an outbound webhook URL that resolved to internal addresses (cloud metadata, loopback, RFC1918), and the response body was persisted and exposed in the project settings UI. Fixed by validating URLs against a private-address blocklist before each delivery.
MediumGSSA-2026-05-JHA9SZMay 4, 2026Bearer tokens and webhook signatures could leak to Sentry
Sentry capture ran without a beforeSend filter, so caught errors carrying request metadata (Authorization headers, x-hub-signature-256, GitHub installation tokens, JWT bodies) could be serialized into Sentry events. Fixed by adding a recursive scrubber on both server and edge runtimes.
Medium