Repository navigation
Security: twikoojs/twikoo
Security
No security policy detected
This project has not set up a SECURITY.md file yet.
Report a vulnerability-
评论接口存在 NoSQL 查询条件注入，可导致越权删除评论及绕过评论可见性限制GHSA-p6vw-9xhw-rf95 published
Sep 20, 2026 by imaegooHigh -
In the official self hosted server (the tkserver package the project's own Docker image installs), the self service comment delete endpoint compares an unauthenticated caller's accessToken against the comment's stored uid with plain strict equality; since ordinary visitors who never log in as admin always send an undefined accessToken, and every anonymous comment is stored with the same undefined uid, the equality check passes for any anonymous comment on the site, letting any unauthenticated visitor delete any other visitor's comment by its publicly visible idGHSA-84vj-r967-83pv published
Sep 7, 2026 by imaegooModerate -
Vercel 实现中的共享 accessToken 可导致并发身份串扰与管理员权限绕过GHSA-v2mm-mvcv-48p5 published
Sep 7, 2026 by imaegooHigh -
Twikoo 公开图片上传接口存在路径穿越，可导致未经身份验证的任意文件覆盖GHSA-3q3f-grmp-83pj published
Sep 7, 2026 by imaegooCritical -
当前版本依赖的 Nodemailer 中的拒绝服务漏洞GHSA-m9gr-ch6h-vc5g published
Jun 16, 2026 by imaegooHigh
Learn more about advisories related to twikoojs/twikoo in the GitHub Advisory Database