This release includes 2 security fixes for security teams reviewing exposed deployments.
Topics
+4 more
Affected surfaces
ReleasePort's take
Moderate signalReleasePort Layer 1 v2.0.5 patches CVE‑2026‑55696 and CVE‑2026‑55891, adding security mitigations for attachment rendering and API response handling while fixing several bugs.
Why it matters: CVE severity high (95) triggers immediate patching; prevents browsers from rendering unsafe attachments and stops reflected JSON injection via GET parameters.
Summary
AI summaryUpdates CVE-2026-55696, CVE-2026-55891, and XSS across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Prevents browsers from rendering unsafe attachments like HTML in a new tab Prevents browsers from rendering unsafe attachments like HTML in a new tab Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Security | Critical |
Removes GET parameters from JSON API responses to avoid reflected JSON injection Removes GET parameters from JSON API responses to avoid reflected JSON injection Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Displays OS‑specific copy hotkey hint (Cmd+c on Mac, Ctrl+c elsewhere) Displays OS‑specific copy hotkey hint (Cmd+c on Mac, Ctrl+c elsewhere) Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Corrects state corruption after "Remove attachment" operation Corrects state corruption after "Remove attachment" operation Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Low |
Ensures copy button is visible when document is rendered as markdown Ensures copy button is visible when document is rendered as markdown Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Low |
Fixes parsing of shortened URLs from YOURLS service Fixes parsing of shortened URLs from YOURLS service Source: llm_adapter@2026-07-15 Confidence: high |
— |
Full changelog
- CHANGED: Show OS-specific copy hotkey hint (Cmd+c on Mac, Ctrl+c on others) (#1506)
- FIXED: Prevent browsers from rendering unsafe attachments like HTML in a new tab (CVE-2026-55696)
- FIXED: State corruption after "Remove attachment" (#1824)
- FIXED: Copy button is hidden if the document is made as markdown (#1703)
- FIXED: Shortened URLs from YOURLS received but failed to parse (#1844)
- FIXED: Insert only base path in JSON API responses, without GET parameters (CVE-2026-55891)
This release addresses issues with browsers rendering unsafe attachments like HTML and lacking sanitation base path in JSON API responses. More details on this issue can be found in the security advisories:
Security Fixes
- CVE-2026-55696 — Prevent browsers from rendering unsafe attachments like HTML in a new tab
- CVE-2026-55891 — Insert only base path in JSON API responses, without GET parameters
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About PrivateBin
A minimalist, open source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256 bits AES.
Beta — feedback welcome: [email protected]