hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-06-29 16:47:09 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
58bb4c2f4dd64b6988993accf632cf9789b5430d
codeql/javascript/ql/src/change-notes/released/2.4.0.md
github-actions[bot] 237c5639e2 Release preparation for version 2.26.0
2026-06-25 15:27:00 +00:00

585 B
Raw Blame History

2.4.0

New Queries

  • Added a new query, js/system-prompt-injection, to detect cases where untrusted, user-provided values flow into the system prompt of an AI model, allowing an attacker to manipulate the model's behavior.
  • Added a new experimental query, javascript/ssrf-ipv6-transition-incomplete-guard, to detect SSRF host-validation guards that reject private IPv4 ranges but fail to unwrap IPv6-transition forms (IPv4-mapped ::ffff:, NAT64 64:ff9b::, 6to4 2002::), allowing the guard to be bypassed by wrapping an internal IPv4 address in a transition literal.