Hinotoi-agent

OnnxOCR WebUI table preview renders OCR-derived HTML without sanitization

Summary

OnnxOCR's browser WebUI renders table-recognition HTML returned by /table_api directly with innerHTML. The table HTML is assembled from OCR-recognized cell text without escaping those cell values first. A crafted image containing table cell text that is recognized as HTML-like markup can therefore be reflected into the WebUI DOM as executable HTML/JavaScript in the OnnxOCR origin.

This is a WebUI/client-side issue. I am not claiming direct unauthenticated server-side RCE from this path alone. The risk is most relevant when an operator uses the WebUI to process attacker-supplied table images, or when another workflow renders the html field returned by /table_api with the same trust assumption.

Reviewed commit: 23b9798c261ea0a23ccf6823f1bf692e4bd4e98c

agrimble

alias ll='ls -alh'
alias gs='git status'
alias gp='git pull --rebase'

choco-bot

<?xml version="1.0" encoding="utf-8"?>
<registrySnapshot xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <user>S-1-5-21-1723274180-1903406664-1597365815-1000</user>
  <keys>
    <key installerType="Custom" displayName="wmux" displayVersion="2.12.0">
      <RegistryView>Registry64</RegistryView>
      <KeyPath>HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\wmux</KeyPath>
      <DefaultValue />
      <InstallLocation><![CDATA[C:\Users\vagrant\AppData\Local\wmux]]></InstallLocation>
      <UninstallString><![CDATA["C:\Users\vagrant\AppData\Local\wmux\Update.exe" --uninstall -s]]></UninstallString>

isadora121715-creator

devanbay

alias ll='ls -alh'
alias gs='git status'
alias gp='git pull --rebase'

if1025

alias ll='ls -alh'
alias gs='git status'
alias gp='git pull --rebase'

rxuohon

alias ll='ls -alh'
alias gs='git status'
alias gp='git pull --rebase'

HugsLibRecordKeeper

Log uploaded on Wednesday, May 27, 2026, 5:40:25 PM
Loaded mods:
Auto Mod Config (Continued)(Garethp.ModlistConfigurator)[v:1.0.4]: ModlistConfigurator(0.0.0)
Load Them Last(ferny.LoadThemLast): LoadThemLast(1.0.0)
Prepatcher(zetrith.prepatcher): 0Harmony(2.4.2), 0PrepatcherAPI(1.2.0), 0PrepatcherDataAssembly(1.0.0), PrepatcherImpl(1.0.0), Prestarter(1.0.0)
Harmony(brrainz.harmony)[v:2.4.2.0][mv:2.4.2.0]: 0Harmony(av:2.4.2,fv:2.4.1), HarmonyMod(2.4.2)
Loading Progress(ilyvion.LoadingProgress)[v:0.10.0]: ilyvion.LoadingProgress(0.10.0)
Core(Ludeon.RimWorld): (no assemblies)
Royalty(Ludeon.RimWorld.Royalty): (no assemblies)
Ideology(Ludeon.RimWorld.Ideology): (no assemblies)

choco-bot

2026-05-27 23:48:42,766 444 [DEBUG] - XmlConfiguration is now operational
2026-05-27 23:48:43,047 444 [DEBUG] - Adding new type 'CygwinService' for type 'IAlternativeSourceRunner' from assembly 'choco'
2026-05-27 23:48:43,047 444 [DEBUG] - Adding new type 'CygwinService' for type 'IInstallSourceRunner' from assembly 'choco'
2026-05-27 23:48:43,047 444 [DEBUG] - Adding new type 'PythonService' for type 'IAlternativeSourceRunner' from assembly 'choco'
2026-05-27 23:48:43,047 444 [DEBUG] - Adding new type 'PythonService' for type 'IListSourceRunner' from assembly 'choco'
2026-05-27 23:48:43,047 444 [DEBUG] - Adding new type 'PythonService' for type 'IInstallSourceRunner' from assembly 'choco'
2026-05-27 23:48:43,095 444 [DEBUG] - Adding new type 'PythonService' for type 'IUninstallSourceRunner' from assembly 'choco'
2026-05-27 23:48:43,095 444 [DEBUG] - Adding new type 'RubyGemsService' for type 'IAlternativeSourceRunner' from assembly 'choco'
2026-05-27 23:48:43,095 444 [DEBUG] - Adding new type 'RubyGe

JVictorV

// =============================================================================
//  WhatsApp Web — bulk delete chats inactive ≥ DAYS days
//
//  USAGE
//    1. Open https://web.whatsapp.com, wait until chats load.
//    2. DevTools (Cmd+Opt+I) → Console.
//    3. Edit DAYS / DRY_RUN / MAX_DELETES at the top, paste this whole file.
//
//  HOW IT WORKS
//    Reads chats from the page's internal model (WAWebChatCollection), filters