eric/apprise-forge-notifications
Watch
1
0
Fork
You've already forked apprise-forge-notifications
 0
Code Issues Pull requests Projects Releases 5 Packages 1 Wiki Activity Actions
5 releases 9 tags
  • 1.5.4 6113816b45

    1.5.4
    All checks were successful
    Build and Publish Docker Image / test (push) Successful in 24s
    Details
    Build and Publish Docker Image / build-and-push (push) Successful in 15s
    Details
    Stable

    eric released this 2026-07-01 21:46:52 -07:00 | 2 commits to main since this release

    v1.5.4 - Security fix: HTML injection in notifications

    escape_markdown() escaped []()*_\`` but not </>`, so raw HTML tags in attacker-controlled commit messages, issue/PR/comment/review/release bodies, or titles rendered as live masked phishing links on Telegram and HTML-format email destinations (both default to HTML rendering). Not exploitable on Discord/Slack/Mattermost/Matrix/MSTeams/Rocket.Chat.

    Fix: </> now entity-encoded (&lt;/&gt;) instead of backslash-escaped, since python-markdown doesn't honor \< as an escape.

    Upgrade recommended, especially if you notify via Telegram or email.

    Downloads