github.com/daytonaio/daytona
Go · Package
Vulnerability alerts
Follow| Report | Product | Ecosystem | Severity | Fix status | Last updated |
|---|---|---|---|---|---|
| Daytona: Public sandbox previews remain accessible for up to one hour after being made private | github.com/daytonaio/daytona | Go | High | Fix reported | |
| Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles | github.com/daytonaio/daytona | Go | High | Fix reported | |
| Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape | github.com/daytonaio/daytona | Go | Medium | Fix reported | |
| Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join | github.com/daytonaio/daytona | Go | Medium | Fix reported |