pheditor/pheditor
Composer · Package
Vulnerability alerts
Follow| Report | Product | Ecosystem | Severity | Fix status | Last updated |
|---|---|---|---|---|---|
| Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter | pheditor/pheditor | Composer | Critical | Fix reported | |
| Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection | pheditor/pheditor | Composer | High | Fix reported | |
| Pheditor has an authenticated terminal command whitelist bypass | pheditor/pheditor | Composer | High | Fix reported | |
| Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes | pheditor/pheditor | Composer | High | Fix reported | |
| Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password | pheditor/pheditor | Composer | Critical | Fix reported | |
| Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise | pheditor/pheditor | Composer | Critical | Fix reported |