@freemo CVE-2023-36460 AKA TootRoot
9.9 CVE score
🇳🇱
@freemo A new critical vulnerability found in mastadon that got a 9.9 CVE which apparently is not yet found in the wild but when fully disclosed will be root access from your toot'n server.
@twotwenty well our version doesnt track masto anymore, but I will be pulling a lot in in the near future as im working on the next version.
It apparently was introduced in v3.5.0 and fixed (patched) from v3.5.9 up.
@freemo apparently you will want to get to 4.1.2 ASAP... usually vulns like this come with a few patches over the following xyz short period of time.