Issues

• [Medium] Argument injection on Windows and Cypher injection in stats script

  securityseverity:medium
  tari-project/dan-testing#85 · Filter by author SWvheerden opened on Sep 11, 2026

• [Medium] Vulnerable frontend dependencies and unpinned Python dependencies

  securityseverity:medium
  tari-project/dan-testing#84 · Filter by author SWvheerden opened on Sep 11, 2026

• [Medium] Workflow expression injection from workflow_dispatch inputs and branch names

  securityseverity:medium
  tari-project/dan-testing#83 · Filter by author SWvheerden opened on Sep 11, 2026

• [Medium] No RPC param validation, single-threaded server DoS, exception text leaked to callers

  securityseverity:medium
  tari-project/dan-testing#82 · Filter by author SWvheerden opened on Sep 11, 2026

• [Medium] Hardcoded credentials (wallet password "a", Neo4j password123)

  securityseverity:medium
  tari-project/dan-testing#81 · Filter by author SWvheerden opened on Sep 11, 2026

• [Medium] All spawned daemons listen on 0.0.0.0; LISTEN_ONLY_ON_LOCALHOST is a no-op; wallet daemon self-grants Admin

  securityseverity:medium
  tari-project/dan-testing#80 · Filter by author SWvheerden opened on Sep 11, 2026

• [High] CI supply chain: unpinned third-party action runs after registry login with inherited secrets

  securityseverity:high
  tari-project/dan-testing#79 · Filter by author SWvheerden opened on Sep 11, 2026

• [High] Unauthenticated burn RPC spends wallet funds and writes to caller-chosen path

  securityseverity:high
  tari-project/dan-testing#78 · Filter by author SWvheerden opened on Sep 11, 2026

• [High] XSS in webui log viewer via dangerouslySetInnerHTML

  securityseverity:high
  tari-project/dan-testing#77 · Filter by author SWvheerden opened on Sep 11, 2026

• [High] Vite dev servers exposed on 0.0.0.0 with known file-disclosure CVEs

  securityseverity:high
  tari-project/dan-testing#76 · Filter by author SWvheerden opened on Sep 11, 2026

• [High] Path traversal in WASM template file server (arbitrary file read, all interfaces)

  securityseverity:high
  tari-project/dan-testing#75 · Filter by author SWvheerden opened on Sep 11, 2026

• [Critical] Path traversal in /upload_template gives arbitrary file delete/write (RCE)

  securityseverity:critical
  tari-project/dan-testing#74 · Filter by author SWvheerden opened on Sep 11, 2026

• [Critical] Unauthenticated JSON-RPC control plane on 0.0.0.0 with arbitrary file read and wildcard CORS

  securityseverity:critical
  tari-project/dan-testing#73 · Filter by author SWvheerden opened on Sep 11, 2026