Repository navigation
Security and privacy bugs epic, june 2026 #56
Description
The description of this issue will be provided when a fix is available.
This epic tracks the individual placeholders:
- [Security] Build artifacts loaded/executed from world-writable shared directories without integrity check (DLL planting) #45
- [Security] Build-daemon named pipe: NULL DACL + unauthenticated Start-packet loads arbitrary assemblies (code execution) #46
- [Security] Learning Hub content.xml parsed with XXE-enabled XmlDocument #47
- [Security] CEIP/telemetry encrypted payload uploaded over plaintext HTTP #48
- [Security] Unscoped, World-writable CPU-throttle semaphore enables local build DoS #50
- [Security] Compiler host writes full unscrubbed exception to a plaintext temp file #51
- [Privacy] Exception-report scrubber is a weak denylist that leaks secrets/PII to the vendor #53
- [Privacy] Telemetry opt-out does not stop already-queued uploads #54
- [Privacy] Per-usage telemetry anonymizes type names with reversible unsalted 32-bit FNV-1a #55
Metadata
Metadata
Assignees
Type
Projects
- Status
Activity
[-]Placeholder for #48[/-][+]Security and privacy bugs epic, june 2026[/+]gfraiteur commentedon Jun 27, 2026
Released in v2024.0.24.
-- Claude for Gael
gfraiteur commentedon Jun 27, 2026
Also released in v2026.0.13, which includes the upstream 2024.0.24 changes.
-- Claude for Gael