PrivateBin

• CHANGED: Show OS-specific copy hotkey hint (Cmd+c on Mac, Ctrl+c on others) (#1506)
• FIXED: Prevent browsers from rendering unsafe attachments like HTML in a new tab (CVE-2026-55696)
• FIXED: State corruption after “Remove attachment” (#1824)
• FIXED: Copy button is hidden if the document is made as markdown (#1703)
• FIXED: Shortened URLs from YOURLS received but failed to parse (#1844)
• FIXED: Insert only base path in JSON API responses, without GET parameters (CVE-2026-55891)

This release addresses issues with browsers rendering unsafe attachments like HTML and lacking sanitation base path in JSON API responses. More details on this issue can be found in the security advisories:

• Stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction (CVE-2026-55696)
• Reflected JSON injection in backend responses via unescaped REQUEST_URI (CVE-2026-55891)