Repository navigation
Security: ls1intum/Artemis
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
LTI 1.3 launch redirect: Host-header open redirect + id_token leakGHSA-chmx-whjx-5pw6 published
Sep 28, 2026 by kruscheLow -
Stale JWT role claims: demotion/deactivation ineffective until expiryGHSA-f8pw-2mjg-qp8q published
Sep 28, 2026 by kruscheModerate -
Authenticated blind SSRF in Artemis link-preview endpoint: the URL allowlist inspects only the hostname string, so a DNS name resolving to an internal IP (e.g. 169.254.169.254.nip.io) or an HTTP redirect makes the server issue attacker-directed requests to internal hosts.GHSA-r7gh-5p9f-wp88 published
Sep 28, 2026 by kruscheModerate -
Permission Check Bypass for reading/writing to Git repositories using GIT_SMART_HTTP=0GHSA-fcr7-rfrq-9pgw published
Aug 30, 2026 by kruscheCritical -
Artemis: Authentication vulnerabilityGHSA-w73x-xp2x-5c66 published
Aug 30, 2026 by kruscheCritical -
Artemis: Privilege Escalation to AdministratorGHSA-5g7p-c43f-2j9c published
Aug 30, 2026 by kruscheCritical