Issues · aglover1221/product-data-extractor · GitHub

Labels Milestones New issue

[bug] SSRF via LLM-controlled URLs in source acquisition + unbounded response buffering across pdf-validation and Reducto download paths

#40

· galuis116 opened

on May 26, 2026

[bug] Prototype pollution via spot-fix field_path - annotation API accepts unvalidated paths that setField then writes to Object.prototype

#38

· galuis116 opened

on May 26, 2026

[bug] Worker handlers are not idempotent under lease reclaim — duplicate writes, lost cost accounting, and inflated/erased counters on retry

#36

· galuis116 opened

on May 26, 2026

Critical: Manual source upload API allows unauthenticated path traversal write outside `PRODUCT_MCP_DATA_DIR` via `docType`

#34

· jonathanchang31 opened

on May 26, 2026

[bug] schema save/rollback writes filesystem before DB with no rollback on insert failure

#32

· kiannidev opened

on May 26, 2026

[bug] appendProductMdSource silently skips MD manifest update on missing or malformed frontmatter

#30

· kiannidev opened

on May 26, 2026

[bug] extraction index cache never invalidated after writes — stale reads for 30s

#28

· kiannidev opened

on May 26, 2026

[bug] batch worker writes extraction.json to {DATA_DIR}/{slug}/ instead of nested product path

#26

· kiannidev opened

on May 26, 2026

[Bug] Orphan sweep API deletes product source files when `sources.yaml` is missing

#24

· Desel72 opened

on May 23, 2026

Critical: Unauthenticated commit API can create product markdown files outside `PRODUCT_MCP_DATA_DIR` via path traversal

#22

· Desel72 opened

on May 23, 2026

[UI Enhancement] Update Portforlio UI

#21

· calebbrooksdev-ctrl opened

on May 23, 2026

[UI Enhancement] - Make NavBar fully responsive

#19

· bittensorrider opened

on May 22, 2026