Search results

[Vulnerability] Hardcoded JWT Secret May Lead to Privilege Escalation Risks

Status: Open.

#1043 In SonicJs-Org/sonicjs;

· lx915 opened on Jul 25, 2026

security: slug-validate field_name on write to close fieldId XSS sink

securitySecurity vulnerabilitiesSecurity vulnerabilities

Status: Open.

#1031 In SonicJs-Org/sonicjs;

· lane711 opened on Jul 24, 2026

Security: media field value renders unescaped (stored XSS)

Status: Open.

#1028 In SonicJs-Org/sonicjs;

· mmcintosh opened on Jul 23, 2026

Security: number/date/datetime field inputs render the stored value unescaped (stored XSS)

Status: Open.

#1026 In SonicJs-Org/sonicjs;

· mmcintosh opened on Jul 23, 2026

Security: global-variables API allows unauthenticated read + write of site-wide config

Status: Open.

#1023 In SonicJs-Org/sonicjs;

· mmcintosh opened on Jul 22, 2026

Security: user-profiles API allows unauthenticated read/write of any user's profile data

Status: Open.

#1021 In SonicJs-Org/sonicjs;

· mmcintosh opened on Jul 22, 2026

First-boot FK race + no single-flight leaves RBAC/plugins unseeded and latches the broken state (beta.25)

Status: Open.

#1017 In SonicJs-Org/sonicjs;

· mmcintosh opened on Jul 20, 2026

beta.25 cold-start caches break outside a Workers isolate — ~25 core unit tests fail on a clean checkout

Status: Open.

#1016 In SonicJs-Org/sonicjs;

· mmcintosh opened on Jul 20, 2026

fix: reconcile code-defined collection types on cached bootstrap

Status: Open.

#1014 In SonicJs-Org/sonicjs;

· bobbwal opened on Jul 19, 2026

docs: website advertises v3.0.0-beta.24 after v3.0.0-beta.25 release

Status: Open.

#1012 In SonicJs-Org/sonicjs;

· bobbwal opened on Jul 18, 2026

npm ci fails on main: package-lock.json is out of sync with package.json

Status: Open.

#1011 In SonicJs-Org/sonicjs;

· bobbwal opened on Jul 18, 2026

[3.0.0-beta.17] SonicJSConfig disabled plugins show in Sidebar

Status: Open.

#971 In SonicJs-Org/sonicjs;

· LukeSeers opened on Jun 29, 2026