Career Ops UI

v1.106.0 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 21d Productivity & Wikis

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 2 known CVEs

Topics

airbnb-style ashby ats career-ops claude-code cv

+11 more

express greenhouse-api hh-ru job-application job-search lever local-first no-telemetry resume self-hosted sse

Affected surfaces

auth rbac

Summary

AI summary

Error messages are HTML‑escaped and config writes reject prototype‑pollution keys, fixing XSS and prototype‑pollution risks.

Full changelog

[1.106.0] — 2026-07-06

Security hardening (CodeQL triage). Fixed three real (if low-severity) findings from a pass over the static-analysis backlog: the route-render error path now escapes the error message before it reaches the DOM (a server error can echo user-supplied input, so it's treated as untrusted — XSS boundary), and the profile/config property writes reject __proto__ / constructor / prototype keys (belt-and-braces prototype-pollution guards — the keys come from fixed field specs, not raw request input). The bulk of the remaining alerts are false positives on the scanner's legitimate data/* reads/writes and on routes that already carry the app's custom rate-limiter, and were dismissed with rationale.

public/js/router.js escapes err.message via UI.escapeHtml before innerHTML; server/lib/routes/content.mjs (setArray/setDotted) and server/lib/routes/config.mjs (the env-apply loop) guard prototype keys. No behavior change for valid input. Tests: tests/security-hardening-v1106.test.mjs (3). No new i18n keys.

New: none.

Security Fixes

Error messages in `public/js/router.js` are now HTML‑escaped via `UI.escapeHtml`, preventing XSS when server errors contain user input.
`server/lib/routes/content.mjs` and `server/lib/routes/config.mjs` reject writes with keys `__proto__`, `constructor`, or `prototype`, mitigating prototype‑pollution attacks.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Career Ops UI

Get notified when new releases ship.

About Career Ops UI

All releases →