Apr — May 2026 · Profound
Two SSRF holes, an open postMessage and a CVE
Security work in a multi-tenant product, mostly found by reading code nobody was looking at.
None of these came from a report. They came from working in the surrounding code and noticing something.
The findings
- An API key identifier went into an outbound URL without validation — a server-side request forgery vector, since the server would fetch whatever the identifier pointed at.
- User-controlled path segments were interpolated into GitHub API calls unencoded. Same class of bug, different door.
- The CMS and the previewed site talked over postMessage with no origin allow-list, so any page in that iframe could send messages the CMS trusted. Alongside it, markdown was rendered without sanitisation. Together that is an XSS path across the trust boundary between the CMS and content it does not control.
- CVE-2026-23864 in Next.js — an upgrade, plus verifying nothing in our usage broke on the way.
The one that needed design, not a patch
The postMessage fix is origin allow-listing, which is small. The markdown fix is a single sanitisation layer that everything renders through, which is not small, because the interesting question is what to allow rather than what to strip. Sanitisers that strip too much break real content and get bypassed by whoever needs the content to work.