Fixes critical privilege escalation and resource exhaustion vulnerabilities, updates dependencies, and adds multer installation instructions to README.
The /api/users/register endpoint allowed clients to specify their role, leading to trivial admin privilege escalation. A "zip bomb" protection was added to the DB restore process to prevent resource exhaustion during gzip decompression. Additionally, npm audit fix was run to address reported dependency vulnerabilities.
Fixes critical privilege escalation and resource exhaustion vulnerabilities, updates dependencies, and adds `multer` installation instructions to README.
The `/api/users/register` endpoint allowed clients to specify their `role`, leading to trivial admin privilege escalation. A "zip bomb" protection was added to the DB restore process to prevent resource exhaustion during gzip decompression. Additionally, `npm audit fix` was run to address reported dependency vulnerabilities.
---
<a href="https://cursor.com/background-agent?bcId=bc-e0d1ada5-d268-4d07-ba11-574631910c1c"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/open-in-cursor-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/open-in-cursor-light.svg"><img alt="Open in Cursor" src="https://cursor.com/open-in-cursor.svg"></picture></a> <a href="https://cursor.com/agents?id=bc-e0d1ada5-d268-4d07-ba11-574631910c1c"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/open-in-web-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/open-in-web-light.svg"><img alt="Open in Web" src="https://cursor.com/open-in-web.svg"></picture></a>
Cursor Agent can help with this pull request. Just @cursor in comments and I'll start working on changes in this branch. Learn more about Cursor Agents
Cursor Agent can help with this pull request. Just `@cursor` in comments and I'll start working on changes in this branch.
<sub>[Learn more](https://cursor.com/docs/background-agent/web-and-mobile) about Cursor Agents</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Fixes critical privilege escalation and resource exhaustion vulnerabilities, updates dependencies, and adds
multerinstallation instructions to README.The
/api/users/registerendpoint allowed clients to specify theirrole, leading to trivial admin privilege escalation. A "zip bomb" protection was added to the DB restore process to prevent resource exhaustion during gzip decompression. Additionally,npm audit fixwas run to address reported dependency vulnerabilities.Cursor Agent can help with this pull request. Just
@cursorin comments and I'll start working on changes in this branch.Learn more about Cursor Agents