GHSA-hp9m-vff5-7pvw, Moderate, CWE-79. Stored board, list and card titles and other activity values were interpolated into localized notification prose before that prose was used as an HTML email body. A writable member could therefore place active markup in a title and have it delivered to another member’s mail client.

The complete localized notification is now HTML-escaped once at the final output boundary, before its plain-text newlines become HTML line breaks. This protects every current and future activity parameter without changing ordinary text or the plain-text notification mode. The subject formatter also removes newlines so stored values cannot create additional mail headers. Positive and negative unit coverage exercises active markup, ordinary titles, header newlines, the final output wiring and all 246 locale bundles.

CookieTokenBleed - GHSA-8phm-9rqm-v9hc, Moderate, CWE-1004. WeKan’s custom file-route authentication mirror wrote the Meteor resume token into a cookie from browser JavaScript, which cannot apply the HttpOnly attribute. Meteor also kept its original token in Local Storage, so script running in the WeKan origin could read either persistent copy.

WeKan now enables Meteor 3.5’s maintained HttpOnly resume-cookie flow on both client and server with persistent Web Storage disabled. The custom readable cookie synchronization and bootstrap code is removed, leaving only an in-memory credential in the active tab. Header login applies HttpOnly as well as SameSite=Lax and HTTPS Secure to the cookies it issues. Positive and negative regression coverage pins both configurations, the absence of browser cookie/token copying and retention of the Secure header-login path; existing request-auth and session-isolation suites remain green.