Issues

• yaml.FullLoader used instead of SafeLoader in pack metadata parsing (CWE-502)

  StackStorm/st2#6393 · Filter by author jaredbischof opened on Jul 20, 2026
  1

• Git worktree directories created with chmod 777 (CWE-732)

  StackStorm/st2#6392 · Filter by author jaredbischof opened on Jul 20, 2026

• Predictable temp directory paths in pack management enable symlink attacks (CWE-377)

  StackStorm/st2#6391 · Filter by author jaredbischof opened on Jul 20, 2026

• CORS middleware reflects Origin with Allow-Credentials, enabling cross-origin attacks (CWE-346)

  StackStorm/st2#6390 · Filter by author jaredbischof opened on Jul 20, 2026

• HTTP runner defaults to verify=False, disabling TLS certificate validation (CWE-295)

  StackStorm/st2#6389 · Filter by author jaredbischof opened on Jul 20, 2026

• Jinja2 auto-escape disabled in spec_loader (CWE-79)

  StackStorm/st2#6388 · Filter by author jaredbischof opened on Jul 20, 2026

• Regular Expression Denial of Service (ReDoS) in check_processes action (CWE-400)

  StackStorm/st2#6387 · Filter by author jaredbischof opened on Jul 20, 2026

• SSH host key verification disabled in paramiko runner (CWE-295)

  StackStorm/st2#6386 · Filter by author jaredbischof opened on Jul 20, 2026

• Command Injection via unsanitized input in subprocess calls (CWE-78)

  StackStorm/st2#6385 · Filter by author jaredbischof opened on Jul 20, 2026

• [TEN-87733] AMQP Cleartext Authentication — "The remote Advanced Message Queuing Protocol (AMQP) service supports one or more authentication mechanisms that allow credentials to be sent in clear text"

  StackStorm/st2#6383 · Filter by author nandinisingh-1901 opened on Jul 7, 2026
  1

• API key creation allows a non-admin to bind a key to any user and gain that user's privileges (privilege escalation to admin)

  StackStorm/st2#6380 · Filter by author geo-chen opened on Jun 20, 2026

• Execution User Impersonation Allows Cross-Account KV Secret Exfiltration (All Versions Including 3.9.0)

  StackStorm/st2#6379 · Filter by author geo-chen opened on Jun 20, 2026

• Allow st2-run-pack-tests to emit machine-readable coverage reports and aggregate coverage across packs

  StackStorm/st2#6377 · Filter by author anurag-bug opened on Jun 17, 2026

• Action execution fails with KeyError '_cls' when parameters contain '_ref' keys

  StackStorm/st2#6376 · Filter by author jlesuer87 opened on Apr 17, 2026

• stackstorm statsd metrics per action, by action_ref

  StackStorm/st2#6361 · Filter by author danxg87 opened on Nov 12, 2025
  2

• Add Timeout Option for st2 pack install

  StackStorm/st2#6349 · Filter by author docbyte86 opened on Aug 20, 2025
  4

• Signed SSH Certificates Support

  StackStorm/st2#6346 · Filter by author freddierice opened on Aug 14, 2025

• Fix PEM formatting bug when loading private SSH keys in _get_pkey_object

  StackStorm/st2#6338 · Filter by author amritupreti opened on Jul 4, 2025
  15

• Keypair API response inconsistency admin vs. non-admin when calling system scoped keys

  StackStorm/st2#6335 · Filter by author fdrab opened on May 29, 2025

• Workflow finishes too early when parallel branches are running

  StackStorm/st2#6316 · Filter by author Dupangel opened on Mar 13, 2025
  12

• Multiple Policies to Govern a single Action/Workflow

  StackStorm/st2#6310 · Filter by author jpavlav opened on Mar 5, 2025

• How to create custom MongoDB indexes

  StackStorm/st2#6280 · Filter by author n-tanaka-idcf opened on Nov 18, 2024
  3

• Stackstorm UI not masking the secret values

  StackStorm/st2#6272 · Filter by author kkawatra09 opened on Oct 31, 2024
  3

• Ubuntu 24.04 LTS support?

  StackStorm/st2#6243 · Filter by author mika opened on Sep 16, 2024
  5

• workflow doesn't go ahead next item in case of concurrency: 1

  bugstatus:to be verified
  StackStorm/st2#6234 · Filter by author freeyssu opened on Sep 4, 2024
  2