Repository Issue Activity (beta)

#6331 python_runner.py should check the utf8 length to determine when to use stdin for parameters.

#6393 yaml.FullLoader used instead of SafeLoader in pack metadata parsing (CWE-502)

#6392 Git worktree directories created with chmod 777 (CWE-732)

#6391 Predictable temp directory paths in pack management enable symlink attacks (CWE-377)

#6390 CORS middleware reflects Origin with Allow-Credentials, enabling cross-origin attacks (CWE-346)

#6389 HTTP runner defaults to verify=False, disabling TLS certificate validation (CWE-295)

#6388 Jinja2 auto-escape disabled in spec_loader (CWE-79)

#6387 Regular Expression Denial of Service (ReDoS) in check_processes action (CWE-400)

#6386 SSH host key verification disabled in paramiko runner (CWE-295)

#6385 Command Injection via unsanitized input in subprocess calls (CWE-78)

#5130 Issue with action help display when having ordered optional parameters

#4789 st2 fails to store a Key-Value in the datastore if there is a "/" in the key name.

#6383 [TEN-87733] AMQP Cleartext Authentication — "The remote Advanced Message Queuing Protocol (AMQP) service supports one or more authentication mechanisms that allow credentials to be sent in clear text"

#5943 Unix servers flavors

#6380 API key creation allows a non-admin to bind a key to any user and gain that user's privileges (privilege escalation to admin)

#6379 Execution User Impersonation Allows Cross-Account KV Secret Exfiltration (All Versions Including 3.9.0)

#6377 Allow st2-run-pack-tests to emit machine-readable coverage reports and aggregate coverage across packs

#4561 chatops.post_message seems to be ignoring Slack pretext

#6376 Action execution fails with KeyError '_cls' when parameters contain '_ref' keys

#6364 Ubuntu packages for rabbitmq and erlang from Cloudsmith.io not available

#4682 ST2 CLI: Consistent Pagination

#6359 pin python-ldap

#6234 workflow doesn't go ahead next item in case of concurrency: 1

#6362 bcrypt dependency conflict in v3.8.1 with st2-auth-backend-flat-file

#6225 `packs.get` assumes branch `master`