TWO CVES, ZERO EGO: A MAILPIT STORY

Summary from the TLDR InfoSec newsletter

Mailpit is a lightweight email testing tool used in development that recently had two notable security issues uncovered: a server-side request forgery (SSRF) and a cross-site WebSocket hijacking (CSWSH) flaw. The SSRF bug allowed attackers to abuse a proxy endpoint to access internal services such as cloud metadata, while the WebSocket issue allowed any website to connect and stream all captured emails without authentication. The maintainer quickly fixed both issues in new releases and coordinated CVEs, showing how respectful communication, GitHub Security Advisories, and low-ego collaboration between researchers and developers lead to fast, effective vulnerability remediation.