Contributions

Security fixes shipped
to real projects.

Every vulnerability Sebastion finds in open source ships as a fix, not just a write-up. Filter by status, vulnerability class or project. Sorted latest-first by default; switch to popularity to see the most-contributed-to repositories at the top.

46

Fixes Accepted

33

Projects

36

Case Studies

Projects

CodeGraphContext

CodeGraphContext

CodeGraphContext

4 fixes accepted

Path TraversalCORS MisconfigurationSecurity Fix
samanhappy

mcphub

samanhappy

3 fixes accepted

Security FixInformation Disclosure
NaiboWang

EasySpider

NaiboWang

2 fixes accepted

CORS MisconfigurationCode Injection
infiniflow

ragflow

infiniflow

2 fixes accepted

AuthorizationDeserialization
Softeria

ms-365-mcp-server

Softeria

2 fixes accepted

Security Fix
HKUDS

LightRAG

HKUDS

2 fixes accepted

Input ValidationSecurity Fix
AIPexStudio

AIPex

AIPexStudio

2 fixes accepted

WebSocket SecuritySSRF
ForLoopCodes

contextplus

ForLoopCodes

2 fixes accepted

Path TraversalCommand Injection
gptme

gptme

gptme

2 fixes accepted

Information Disclosure
steipete

summarize

steipete

2 fixes accepted

CORS Misconfiguration
maboloshi

github-chinese

maboloshi

1 fix accepted

Security Fix
labring

FastGPT

labring

1 fix accepted

Path Traversal

Pull requests

231 results · page 1 of 10showing 1-25
OpenCLI-Anything
fix(freecad): sanitize output_path in macro generation to prevent code injection
Input Validation17 May 2026
closedCowAgent
fix(web): prevent path traversal in /api/file endpoint
Path Traversal16 May 2026
closedopenai-agents-python
fix(memory): validate SQLite session table names to prevent SQL injection
SQL Injection15 May 2026
Openmcp-server-neon
fix(oauth): validate redirect_uri in POST /api/authorize and /callback error path
Authorization15 May 2026
Mergedgithub-chinese
fix(translate): prevent XSS via translation API response
Security Fix14 May 2026
Case study →
Open5ire
fix(google): move API key from URL query parameter to x-goog-api-key header
Information Disclosure14 May 2026
Openmobile-mcp
fix(install): validate path in mobile_install_app to prevent path traversal
Path Traversal14 May 2026
Openactual
[WIP] fix(compiler): escape single quotes in $oneof and id literals to prevent SQL injection
SQL Injection14 May 2026
closedmarktext
fix: escape HTML attributes in image tag construction to prevent XSS/RCE
Security Fix14 May 2026
Openmcp-server
fix(static-map): validate custom-marker URL to prevent SSRF (CWE-918)
SSRFCWE-91814 May 2026
OpenLangBot
fix(system): remove /debug/exec endpoint allowing authenticated RCE
Security Fix13 May 2026
closedlobehub
fix(desktop/mcp): prevent command injection in MCP install validation
Command Injection13 May 2026
MergedFastGPT
fix(document): prevent path traversal in meta API route
Path Traversal13 May 2026
Write-up pending
closedragflow
fix: enforce read-only SQL allowlist in ExeSQL agent tool
Security Fix13 May 2026
Openlobehub
fix(desktop): validate skill zipHash to prevent path traversal in cache directory handling
Path Traversal13 May 2026
Openopen-swe
fix(auth): prevent internal error details from leaking to users via Linear/Slack comments
Information Disclosure13 May 2026
Openkernel-images
fix: escape HTML attribute values in markdown htmlTag to prevent stored XSS
Security Fix12 May 2026
closedkhoj
Fix Host header injection in share URL generation (CWE-74)
Security FixCWE-7412 May 2026
Opencamofox-browser
fix: require API key authentication on /tabs/:tabId/evaluate endpoint
Information Disclosure12 May 2026
closedHelloAgents
fix(skill_tool): sanitize $ARGUMENTS to prevent skill-envelope injection
Input Validation12 May 2026
OpenTradingAgents-CN
Add authentication to /api/sync/multi-source endpoints (CWE-862)
Security FixCWE-86212 May 2026
MergedEasySpider
fix(ExecuteStage): prevent CWE-95 code injection via Field["x"] templates
Code InjectionCWE-9512 May 2026
Write-up pending
Openmcp-searxng
fix(url-reader): block DNS-rebinding SSRF via socket-level lookup guard (CWE-918)
SSRFCWE-91811 May 2026
MergedEasySpider
fix(server): restrict CORS and bind local API to loopback (CWE-352)
CORS MisconfigurationCWE-35211 May 2026
Write-up pending
Mergedragflow
security: always use RestrictedUnpickler in deserialize_b64 (CWE-502)
DeserializationCWE-50211 May 2026
Case study →

This page updates automatically. Data sourced from GitHub via Sebastion's autonomous audit pipeline. A Foundation Machines program.