All issues

Search results

[Security] Remote Code Execution (RCE) via Arbitrary MCP Service Creation in Yuxi v0.7.1

Status: Open.

#901 In xerrors/Yuxi;

· Captaince opened on Aug 7, 2026

[Security Vulnerability] Arbitrary Host File Read via Symlink Dereference in Skill Import (v0.7.1)

Status: Open.

#895 In xerrors/Yuxi;

· Captaince opened on Aug 7, 2026

[架构][RFC] 建议改为「PostgreSQL 为主库 + 衍生存储」的 System of Record 架构，根治跨库一致性问题

Status: Open.

#893 In xerrors/Yuxi;

· Alex-Fleet opened on Aug 6, 2026

[安全] 登录仅做账号级锁定、无 IP/全局限速，可被用于账号锁定 DoS

Status: Open.

#883 In xerrors/Yuxi;

· Alex-Fleet opened on Aug 6, 2026

[安全] 头像上传仅信任客户端 content-type 与文件名后缀，可上传 SVG 造成同源存储型 XSS

Status: Open.

#882 In xerrors/Yuxi;

· Alex-Fleet opened on Aug 6, 2026

[安全] URL 抓取存在 DNS rebinding 型 SSRF（私网校验与请求两次独立解析，且解析失败放行）

Status: Open.

#881 In xerrors/Yuxi;

· Alex-Fleet opened on Aug 6, 2026

[Bug] worker 崩溃后处于 running 状态的 run 永不恢复，线程 FIFO 队列被永久卡死

Status: Open.

#880 In xerrors/Yuxi;

· Alex-Fleet opened on Aug 6, 2026

[Bug][数据一致性] 图谱写入跨 Neo4j 与 PostgreSQL 两个独立事务，Neo4j 成功而 PG 失败时靠重试收敛

Status: Open.

#879 In xerrors/Yuxi;

· Alex-Fleet opened on Aug 6, 2026

[Bug][数据一致性] index_file 的 Milvus+PostgreSQL 双写用并发 gather + best-effort 回滚，回滚失败残留单边数据

Status: Open.

#878 In xerrors/Yuxi;

· Alex-Fleet opened on Aug 6, 2026

[Bug][可维护性] Schema 迁移全部走启动时手写 SQL（ensure_knowledge_schema/ensure_business_schema），无版本化无回滚

Status: Open.

#877 In xerrors/Yuxi;

· Alex-Fleet opened on Aug 6, 2026

[Bug][数据一致性] delete_database 跨 MinIO/PostgreSQL（及 Milvus）多步删除非原子，中途失败留下脏数据

Status: Open.

#876 In xerrors/Yuxi;

· Alex-Fleet opened on Aug 6, 2026

[安全] docker-compose 默认凭据为公开弱密码，初始化文档未强制要求修改

Status: Open.

#874 In xerrors/Yuxi;

· Alex-Fleet opened on Aug 6, 2026