Skip to content
Klyo Changelog

Web dependencies patched to close a remote code execution

v1.25.8 security high impact
  • audit
  • compliance

The shipped web image is rebuilt to close three dependency advisories, including a remote code execution.

The bundled framework upgrade closes a remote code execution through the image optimizer when handling SVG files, and a denial-of-service in server actions. The HTML sanitizer closes three sanitizer-bypass issues, and the HTTP-client library closes a denial-of-service and an integrity-check bypass.

No functional behavior changes; the image no longer carries the known-vulnerable versions.

Self-hosted operators must rebuild and recreate the web container to pick up the fixes.