Threats tagged 'ghsa-c67v-vqrp-m5wj'

djust versions prior to 1.0.7 have a vulnerability where state snapshots embedded in client pages are not integrity-checked. This allows a client to modify unsigned state data, such as privilege flags or account information, and send it back to the server to escalate privileges or tamper with business state. The issue is fixed in version 1.0.7 by signing state snapshots and rejecting unsigned or forged snapshots. As a workaround, disabling state snapshots or avoiding storing authorization state in public view attributes mitigates the risk.