In-app reader
The MailPreview feature of debugkit is vulnerable to arbitrary constructor execution. For an application to be vulnerable the following conditions must be true:
debug mode must be enabled.
The hostname must match a 'local' domain or be in an allowlist.
5.2.4 and 4.10.3 contain patches for this issue.
Ensure that debugkit is only part of your development dependencies, and that debug mode is disabled in production environments.
Discussion
Sign in to join the discussion.
Keep reading
Optional: create a free account to save items, track programs, and sync across web + app. Reading stays free.