Jonatan Kłosko

JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcuts

Path traversal in imported file_entries name allows arbitrary file write via URL-type entry download

Livebook Teams identity callback lacks state binding, allowing login CSRF

Livebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated access

Unescaped deployment environment variables in generated setup commands