YApi Abandoned Since 2022: Fork Yapix Exposes Forgable Project Tokens and Critical Sandbox Flaws
YApi, the popular self-hosted API management platform developed by YMFE (Qunar), has remained unmaintained since its last release, version 1.12, in November 2022. The tool provides interface documentation, a Mock.js-based mock server, test suites, Swagger and Postman import, and is used by backend, frontend, and QA teams. It has accumulated 27.7 thousand GitHub stars and its unofficial Docker image has been downloaded more than 600 thousand times, making it a de-facto standard in China.
The project now contains 1,629 open issues. Among them is a report describing remote code execution through mock scripts that received no response. Numerous users also report that the cross-request browser extension no longer functions. Security researcher Perruer decided to continue development under the name Yapix (Apache-2.0 license), preserving full compatibility with existing YApi 1.12 databases while fixing critical issues.
Broken components in 2026
Node.js 22 removed the crypto.createCipher function used by YApi to encrypt project tokens, breaking open API access, CI test automation, and IDE plugins. The frontend build relies on the long-abandoned ykit wrapper around webpack 1 and node-sass 4, which no longer install on modern Node. The client bundle is committed directly to the repository, preventing any UI modifications. Package locks reference dead Chinese npm mirrors that no longer serve packages. The cross-request browser extension was written for Manifest V2 and has been removed from the Chrome Web Store. Production dependencies contain 244 known vulnerabilities according to GitHub Advisory, including 50 critical ones in mongoose 5.7, vm2, and an outdated koa version.
Forgable project tokens
Project tokens are stored as random 20-character strings. Users receive an encrypted string in the format uid|project_token. The encryption key is taken from the passsalt field in config.json; when absent, the code falls back to the constant defaultSalt = 'abcde', which is published on GitHub. Because the key is public, any user with guest access can decrypt their own token, extract the project token, and forge a token containing another user’s uid. The server only verifies that decryption succeeds and then applies the permissions of the supplied uid. Yapix generates a 32-byte random secret on first start if none is configured, rejects legacy tokens by default, and logs any use of legacy tokens when the temporary “legacyTokens” flag is enabled.
Unsafe script execution and other fixes
Mock scripts, test assertions, and pre/post-request scripts were executed on the server using vm2 and the Node vm module, both of which are documented as unsafe. Yapix runs all scripts inside isolated-vm with a fresh isolate per execution, 64 MB memory limit, 3-second CPU time limit, and no access to require, filesystem, or network. Only JSON-serializable data is passed in and out. The Mongoose layer was updated from version 5 to 9, replacing removed methods and callbacks. All API parameters are now filtered to block MongoDB operators. Password storage was changed from salted SHA-1 to scrypt, and the first administrator password is now taken from an environment variable or generated once. LDAP authentication now properly escapes the login and rejects empty passwords.
The client was rebuilt with webpack 5, Babel 7, and dart-sass. A new Manifest V3 browser extension was written that registers content scripts only for user-approved origins. The single remaining vulnerability, prototype pollution in Mock.js 1.1.0, was mitigated by a thin wrapper that filters the “proto” key. Continuous integration verifies that an existing YApi 1.12 database continues to work after migration to Yapix on Node 24.
Related articles
Researchers Bypass RP2350 Secure Debug Lock with Laser Fault Injection and Photon Emission Microscopy
Security researchers have demonstrated a hardware attack that restores Secure Debug access on the RP2350 microcontroller revision A4 despite permanent OTP fuses disabling it. Using photon emission microscopy they first located the exact physical bits of the DEBUGEN register, then applied precisely timed 980 nm laser pulses to flip two critical bits and re-enable the Mem-AP ports. The attack requires decapping the chip from the backside and laboratory equipment costing around $250,000, but succeeds in seconds once calibrated. It bypasses the CRIT1.DEBUG_DISABLE fuse, TrustZone restrictions, and glitch detectors by resetting the device before firmware can re-lock the OTP page. The technique was developed against the updated A4 silicon released after the first Raspberry Pi Hacking Challenge. The work highlights that even heavily hardened microcontrollers remain vulnerable to sophisticated physical attacks when an attacker has direct silicon access.
ServiceNow AI Platform Affected by Five Vulnerabilities Including Critical SQL Injection Flaws
ServiceNow disclosed five vulnerabilities in its AI Platform on September 24, 2026, through a security advisory. Two of the issues received CVSS v4.0 base scores of 9.3 and were rated Critical. CVE-2026-13016 allows unauthenticated remote attackers to perform SQL injection and manipulate database contents under specific conditions. CVE-2026-86860 stems from improper authorization checks that enable data exfiltration and privilege escalation without authentication. The flaws were identified via internal testing, coordinated disclosure, and the company's bug bounty program. ServiceNow urges customers to apply the provided updates immediately to mitigate the risks.
CISA Adds Adobe Commerce and WSO2 Vulnerabilities to Known Exploited Vulnerabilities Catalog
The US Cybersecurity and Infrastructure Security Agency has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. CVE-2026-71362 affects Adobe Commerce and Magento, enabling attackers to escalate privileges through an authorization bypass flaw. CVE-2026-5430 impacts multiple WSO2 API management products and allows JWT authentication bypass, leading to administrator account takeover and remote code execution via arbitrary file uploads. Adobe issued an advisory in August 2026 recommending patches within 30 days, while WSO2 warned about the issue in May 2026. CISA has set a September 27, 2026 deadline for federal agencies to apply updates and investigate potential compromises.
Blackbox Asset Management: Discovering and Identifying IT Infrastructure Without Direct Access
Security Vision expert Fedor Bokov explains how organizations can manage IT assets in blackbox mode when customers refuse to provide credentials or internal documentation. The approach begins with network scanning using tools such as nmap and masscan to detect live hosts and open ports across external and internal perimeters. Identification relies on banner grabbing, HTTP header analysis, favicon inspection, HTML structure, and service fingerprinting to determine exact software versions and operating systems. Examples include extracting Ubuntu 22.04 LTS details from an OpenSSH banner and identifying Checkpoint Gaia from specific HTTP responses on port 443. Further analysis of ports like 1433 and 443 reveals Microsoft SQL Server 2017, nginx 1.28.0, PHP 8.2.29, and Bitrix-Site-Manager instances. The methodology concludes with continuous monitoring cycles that track version changes, new services, and configuration deviations to prioritize vulnerability remediation without traditional inventory access.