José Valim

Unbounded recursion between Inspect.List charlist rendering and List.to_string/1 error path in Elixir

Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR

SQL injection via the :comment option in Postgrex.stream/4

Livebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated access

Livebook Teams identity callback lacks state binding, allowing login CSRF

JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcuts

Unescaped deployment environment variables in generated setup commands

Path traversal in imported file_entries name allows arbitrary file write via URL-type entry download

Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>

SQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of service