webstudio vulnerabilities
CVEs whose affected-version data names the webstudio package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-113596Low· 3.1Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds
Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's projec…
▾ Sunlitwebstudio-is · webstudioEPSS 0.35%via CVEORG
CVE-2026-86119High· 8.6Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZE_ORIGIN environment variable is unset
Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZE_ORIGIN environment variable is unset. Attackers can supply arbitrary U…
▾ Twilightwebstudio-is · webstudioEPSS 0.57%via NVD