Sebastion

Contributions

Security fixes shipped
to real projects.

Every vulnerability Sebastion finds in open source ships as a fix, not just a write-up. Filter by status, vulnerability class or project. Projects and PRs are sorted latest-first by default.

84

Fixes Accepted

62

Projects

35

Case Studies

Projects

artokun

comfyui-mcp

artokun

2 fixes accepted

Path Traversal
orangecoding

fredy

orangecoding

2 fixes accepted

Path TraversalSecurity Fix
ghost-in-the-droid

android-agent

ghost-in-the-droid

1 fix accepted

Path Traversal
dataease

SQLBot

dataease

2 fixes accepted

Code InjectionPath Traversal
jo-inc

camofox-browser

jo-inc

1 fix accepted

Path Traversal
areal-project

AReaL

areal-project

2 fixes accepted

Information DisclosureSSRF
MarSeventh

CloudFlare-ImgBed

MarSeventh

1 fix accepted

SSRF
ros-claw

rosclaw

ros-claw

1 fix accepted

Path Traversal
fdueblab

Micro-Agent

fdueblab

1 fix accepted

Security Fix
Power-Agent

PowerMCP

Power-Agent

1 fix accepted

Path Traversal
y13sint

FreeQwenApi

y13sint

1 fix accepted

Path Traversal
hitesh-kumar123

Travel-Plans-

hitesh-kumar123

2 fixes accepted

SQL InjectionCORS Misconfiguration

Pull requests

118 results · page 1 of 5showing 1-25
Opensublink-worker
fix(ruleGenerators): sanitize customRules site/ip to prevent URL injection
Input Validation28 Jul 2026
Mergedcomfyui-mcp
fix(security): prevent path traversal in upload_image/video/audio filename
Path Traversal28 Jul 2026
Write-up pending
OpenTencentDB-Agent-Memory
fix(storage): prevent path traversal in writeRefMd/readRefMd (CWE-22)
Path TraversalCWE-2228 Jul 2026
Openworkout-cool
fix(workout-session): enforce auth and ownership in sync action (CWE-862/IDOR)
Security FixCWE-86228 Jul 2026
OpenOpen-Generative-AI
fix(upload-binary): prevent SSRF via x-proxy-target-url allowlist
SSRF27 Jul 2026
OpenAI-Trader
fix(agent): avoid leaking internal exception details on self-register
Information Disclosure27 Jul 2026
Openai-hedge-fund
fix(storage): prevent path traversal in /storage/save-json
Path Traversal27 Jul 2026
OpenSongGeneration-Studio
fix(uploads): prevent path traversal in reference audio upload endpoints
Path Traversal26 Jul 2026
Mergedfredy
fix(security): salt password hashes with scrypt (CWE-328)
Security FixCWE-32825 Jul 2026
Write-up pending
OpenGLM-OCR
fix(api): prevent path traversal in /tasks/file endpoint (CWE-22)
Path TraversalCWE-2223 Jul 2026
Openantigravity-storage-manager
fix(telegram): require out-of-band confirmation before linking @username to chatId (CWE-287)
Security FixCWE-28723 Jul 2026
Mergedandroid-agent
fix(test-runner): prevent path traversal in recording endpoints
Path Traversal23 Jul 2026
Write-up pending
Opencli
fix(run): remove new Function() execution of registry stdioFunction (CWE-94)
Security FixCWE-9422 Jul 2026
Opensmithery-cli
fix(run): remove new Function() execution of registry stdioFunction (CWE-94)
Security FixCWE-9422 Jul 2026
Open5ire
fix(deep-link): validate MCP server config from install-server links (CWE-94)
Security FixCWE-9422 Jul 2026
Opensglang-omni
fix(playground): restrict filesystem browser root to prevent path traversal
Path Traversal22 Jul 2026
Opensglang-omni
fix(playground): restrict filesystem browser root to prevent path traversal
Path Traversal22 Jul 2026
Openrowboat
fix(uploads): prevent path traversal in /api/uploads/[fileId] route
Path Traversal22 Jul 2026
Openrowboat
fix(uploads): prevent path traversal in /api/uploads/[fileId] route
Path Traversal22 Jul 2026
Openmarktext
fix(muya): escape HTML in image attribute values (CWE-79)
Security FixCWE-7922 Jul 2026
Mergedfredy
fix(sqlite adapter): prevent path traversal via user-controlled dbPath
Path Traversal21 Jul 2026
Write-up pending
MergedSQLBot
fix(terminology): prevent path traversal in Excel upload
Path Traversal21 Jul 2026
Write-up pending
Mergedcamofox-browser
fix(cookies): harden path traversal check in readCookieFile
Path Traversal21 Jul 2026
Write-up pending
OpenTradingAgents-CN
fix(logs): prevent path traversal in log read/export/delete (CWE-22)
Path TraversalCWE-2220 Jul 2026
OpenUmi-OCR
fix(server): validate Host header on /argv to prevent DNS rebinding RCE
Security Fix20 Jul 2026

This page updates automatically. Data sourced from GitHub via Sebastion's autonomous audit pipeline.