Issues

• [Security] Hardening backlog: environment trust, update URL, config atomicity, plugin lifecycle, path canonicalization

  securityseverity: low
  ProxyCheng/PolyMount#15 · Filter by author ProxyCheng opened on Oct 19, 2026

• [Security] Developer install script exposes the service account password on the sc.exe command line

  securityseverity: low
  ProxyCheng/PolyMount#14 · Filter by author ProxyCheng opened on Oct 19, 2026

• [Security] Network reads have no body timeout or response-size limits

  securityseverity: medium
  ProxyCheng/PolyMount#13 · Filter by author ProxyCheng opened on Oct 19, 2026

• [Security] On-disk data is world-readable and the internal getConfig returns plaintext passwords

  securityseverity: medium
  ProxyCheng/PolyMount#12 · Filter by author ProxyCheng opened on Oct 19, 2026

• [Security] Control pipe resource-exhaustion DoS: unbounded lines/connections and unhandled pipe errors stop the supervisor

  securityseverity: medium
  ProxyCheng/PolyMount#11 · Filter by author ProxyCheng opened on Oct 19, 2026
  1

• [Security] Control pipes can be squatted and clients never authenticate the server

  securityseverity: high
  ProxyCheng/PolyMount#10 · Filter by author ProxyCheng opened on Oct 19, 2026

• [Security] DirectoryLayer follows junctions and symlinks, allowing I/O outside its root

  securityseverity: high
  ProxyCheng/PolyMount#9 · Filter by author ProxyCheng opened on Oct 19, 2026

• [Security] Store databases are trusted: arbitrary blob paths, no integrity, cache poisoning

  securityseverity: high
  ProxyCheng/PolyMount#8 · Filter by author ProxyCheng opened on Oct 19, 2026

• [Security] Mounted volumes expose no per-file ACLs and are accessible machine-wide

  securityseverity: high
  ProxyCheng/PolyMount#7 · Filter by author ProxyCheng opened on Oct 19, 2026

• [Security] A server-controlled href can move subsequent requests to another origin

  securityseverity: high
  ProxyCheng/PolyMount#6 · Filter by author ProxyCheng opened on Oct 19, 2026

• [Security] TLS certificate validation is disabled by default (the default list contains "other")

  securityseverity: high
  ProxyCheng/PolyMount#5 · Filter by author ProxyCheng opened on Oct 19, 2026

• [Security] Stored credentials are not bound to an origin; plain HTTP is accepted

  securityseverity: high
  ProxyCheng/PolyMount#4 · Filter by author ProxyCheng opened on Oct 19, 2026

• [Security] Configuration fields accept arbitrary filesystem paths (source, store, mount point, WinFsp directory, profile id)

  securityseverity: critical
  ProxyCheng/PolyMount#3 · Filter by author ProxyCheng opened on Oct 19, 2026
  1

• [Security] saveConfig loads an arbitrary plugin DLL before validation — code execution as the service account

  securityseverity: critical
  ProxyCheng/PolyMount#2 · Filter by author ProxyCheng opened on Oct 19, 2026

• [Security] Control plane is unauthenticated: any interactive local user can drive the service

  securityseverity: critical
  ProxyCheng/PolyMount#1 · Filter by author ProxyCheng opened on Oct 19, 2026