libwebp day-0 vulnerability
Open
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 44.7k
- Forks
- 3.6k
- Avg merge
- 21m
- Merged PRs (30d)
- 1
Description
- [ X] Your Hyper.app version is 3.4.1. Please verify you're using the latest Hyper.app version
- [ X] I have searched the issues of this repo and believe that this is not a duplicate
Please see ARS Technical Report. Hyper is flagged as vulnerable by Bob Rudis' positron. I'll need to switch to another terminal pending patch (with regret!).
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue identifies a libwebp vulnerability affecting Hyper 3.4.1 and links to the Ars Technica report and positron analysis; no files, tests, or entry points are named. Start by checking how Hyper packages libwebp and whether the reported version is affected, then verify that the dependency is patched and the vulnerability no longer applies.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- macos
- Domain
- desktop, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100