Threats tagged 'ghsa-c36v-xjp4-hxrw'

A security vulnerability (CVE-2026-7581) exists in alexta69 MeTube versions up to 2026.04.09 in the CORS Policy implementation within the on_prepare function of app/main.py. This flaw allows a permissive cross-domain policy that can be exploited remotely by untrusted domains. The vulnerability has a medium severity score of 4.3 and has been publicly disclosed. Upgrading to version 2026.04.10 mitigates the issue.