Unvalidated URL Fields and Weak Tokens Expose Startups to XSS and Supply Chain Attacks

A routine security audit of a software tool's version management system uncovered critical vulnerabilities, including an update endpoint that accepted unsanitized URLs, enabling cross-site scripting (XSS) and server-side request forgery (SSRF) attacks. The artifact creation model accepted any URI format without validation, meaning malicious JavaScript or internal service URLs could be served directly to clients. A second flaw involved a static release token with no rate limiting, giving attackers unlimited brute-force attempts to publish fake, malicious tool versions. Additionally, a markdown-based release notes field stored content without sanitization, allowing anyone with token access to inject persistent scripts executed by every user who rendered the notes. Beyond technical remediation, such vulnerabilities carry serious business consequences, including breach disclosures, enterprise contract suspensions, and reputational damage.