Description
Dyad is a local AI app builder. A critical security vulnerability has been discovered that affected Dyad v0.19.0 and earlier versions that allows attackers to execute arbitrary code on users' systems. The vulnerability affects the application's preview window functionality and can bypass Docker container protections. An attacker can craft web content that automatically executes when the preview loads. The malicious content can break out of the application's security boundaries and gain control of the system. This has been fixed in Dyad v0.20.0 and later.
Problem types
CWE-94: Improper Control of Generation of Code ('Code Injection')
Product status
References
github.com/...h/dyad/security/advisories/GHSA-7fxm-c5xx-7vpq
github.com/...ommit/1c0255ab126d3b38ae9e78b17cdab9a07e5f0185
github.com/...ommit/ebcf89ee6cead83a33add5ef1e19c8d4f9b4ce9b
