Skip to content

PrivateBin

v2.0.5 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 16d Developer Productivity
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Topics

crypto cryptography encrypted one-time paste pastebin
+4 more
php security self-destroy self-hosted

Affected surfaces

auth rce_ssrf

ReleasePort's take

Moderate signal
editorial:auto 12d

ReleasePort Layer 1 v2.0.5 patches CVE‑2026‑55696 and CVE‑2026‑55891, adding security mitigations for attachment rendering and API response handling while fixing several bugs.

Why it matters: CVE severity high (95) triggers immediate patching; prevents browsers from rendering unsafe attachments and stops reflected JSON injection via GET parameters.

Summary

AI summary

Updates CVE-2026-55696, CVE-2026-55891, and XSS across a mixed release.

Changes in this release

Security Critical

Prevents browsers from rendering unsafe attachments like HTML in a new tab

Prevents browsers from rendering unsafe attachments like HTML in a new tab

Source: llm_adapter@2026-07-15

Confidence: high

 —
Security Critical

Removes GET parameters from JSON API responses to avoid reflected JSON injection

Removes GET parameters from JSON API responses to avoid reflected JSON injection

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Low

Displays OS‑specific copy hotkey hint (Cmd+c on Mac, Ctrl+c elsewhere)

Displays OS‑specific copy hotkey hint (Cmd+c on Mac, Ctrl+c elsewhere)

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

Corrects state corruption after "Remove attachment" operation

Corrects state corruption after "Remove attachment" operation

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Low

Ensures copy button is visible when document is rendered as markdown

Ensures copy button is visible when document is rendered as markdown

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Low

Fixes parsing of shortened URLs from YOURLS service

Fixes parsing of shortened URLs from YOURLS service

Source: llm_adapter@2026-07-15

Confidence: high

 —
Full changelog
  • CHANGED: Show OS-specific copy hotkey hint (Cmd+c on Mac, Ctrl+c on others) (#1506)
  • FIXED: Prevent browsers from rendering unsafe attachments like HTML in a new tab (CVE-2026-55696)
  • FIXED: State corruption after "Remove attachment" (#1824)
  • FIXED: Copy button is hidden if the document is made as markdown (#1703)
  • FIXED: Shortened URLs from YOURLS received but failed to parse (#1844)
  • FIXED: Insert only base path in JSON API responses, without GET parameters (CVE-2026-55891)

This release addresses issues with browsers rendering unsafe attachments like HTML and lacking sanitation base path in JSON API responses. More details on this issue can be found in the security advisories:

Security Fixes

  • CVE-2026-55696 — Prevent browsers from rendering unsafe attachments like HTML in a new tab
  • CVE-2026-55891 — Insert only base path in JSON API responses, without GET parameters
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track PrivateBin

Get notified when new releases ship.

Sign up free

About PrivateBin

A minimalist, open source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256 bits AES.

All releases →

Related context

Beta — feedback welcome: [email protected]