AIKIDO-2026-531564

slint-lsp is vulnerable to Missing Authentication for Critical Function

Missing Authentication for Critical FunctionGHSA-p64q-493c-6mmq Published 5 days ago

Medium Risk

This Affects:

slint-lsp

1.17.0 - 1.17.1

Fixed in 1.18.0

Are you affected? Scan for Free

TL;DR

The slint-lsp remote preview connector deserializes each binary WebSocket frame from a connected viewer with postcard::from_bytes::<PreviewToLspMessage> and, except for the heartbeat Pong, forwards it to the LSP handler with no type whitelist, capability check, or source marking. A remote viewer opened through the editor's Remote Preview dialog can then read arbitrary files on the developer's machine and ask the editor to write files. Applications built with Slint, and users who never open a remote connection, are not affected. The fix accepts only diagnostics, debug messages, and file requests from a viewer, and returns those only from within the previewed project.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you connect the editor's Remote Preview dialog to a remote viewer you do not fully control.