YApi Abandoned Since 2022: Fork Yapix Exposes Forgable Project Tokens and Critical Sandbox Flaws
YApi, the popular self-hosted API management platform developed by YMFE (Qunar), has remained unmaintained since its last release, version 1.12, in November 2022. The tool provides interface documentation, a Mock.js-based mock server, test suites, Swagger and Postman import, and is used by backend, frontend, and QA teams. It has accumulated 27.7 thousand GitHub stars and its unofficial Docker image has been downloaded more than 600 thousand times, making it a de-facto standard in China.
The project now contains 1,629 open issues. Among them is a report describing remote code execution through mock scripts that received no response. Numerous users also report that the cross-request browser extension no longer functions. Security researcher Perruer decided to continue development under the name Yapix (Apache-2.0 license), preserving full compatibility with existing YApi 1.12 databases while fixing critical issues.
Broken components in 2026
Node.js 22 removed the crypto.createCipher function used by YApi to encrypt project tokens, breaking open API access, CI test automation, and IDE plugins. The frontend build relies on the long-abandoned ykit wrapper around webpack 1 and node-sass 4, which no longer install on modern Node. The client bundle is committed directly to the repository, preventing any UI modifications. Package locks reference dead Chinese npm mirrors that no longer serve packages. The cross-request browser extension was written for Manifest V2 and has been removed from the Chrome Web Store. Production dependencies contain 244 known vulnerabilities according to GitHub Advisory, including 50 critical ones in mongoose 5.7, vm2, and an outdated koa version.
Forgable project tokens
Project tokens are stored as random 20-character strings. Users receive an encrypted string in the format uid|project_token. The encryption key is taken from the passsalt field in config.json; when absent, the code falls back to the constant defaultSalt = 'abcde', which is published on GitHub. Because the key is public, any user with guest access can decrypt their own token, extract the project token, and forge a token containing another user’s uid. The server only verifies that decryption succeeds and then applies the permissions of the supplied uid. Yapix generates a 32-byte random secret on first start if none is configured, rejects legacy tokens by default, and logs any use of legacy tokens when the temporary “legacyTokens” flag is enabled.
Unsafe script execution and other fixes
Mock scripts, test assertions, and pre/post-request scripts were executed on the server using vm2 and the Node vm module, both of which are documented as unsafe. Yapix runs all scripts inside isolated-vm with a fresh isolate per execution, 64 MB memory limit, 3-second CPU time limit, and no access to require, filesystem, or network. Only JSON-serializable data is passed in and out. The Mongoose layer was updated from version 5 to 9, replacing removed methods and callbacks. All API parameters are now filtered to block MongoDB operators. Password storage was changed from salted SHA-1 to scrypt, and the first administrator password is now taken from an environment variable or generated once. LDAP authentication now properly escapes the login and rejects empty passwords.
The client was rebuilt with webpack 5, Babel 7, and dart-sass. A new Manifest V3 browser extension was written that registers content scripts only for user-approved origins. The single remaining vulnerability, prototype pollution in Mock.js 1.1.0, was mitigated by a thin wrapper that filters the “proto” key. Continuous integration verifies that an existing YApi 1.12 database continues to work after migration to Yapix on Node 24.
Related articles
CISA Adds Apple CVE-2024-27834 to Known Exploited Vulnerabilities Catalog After Confirmed Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency has added the Apple vulnerability CVE-2024-27834 to its Known Exploited Vulnerabilities catalog following confirmed in-the-wild exploitation. The flaw impacts multiple Apple platforms including iOS, iPadOS, macOS, Safari, tvOS, and watchOS. It is an authentication bypass issue that can be exploited for arbitrary read and write operations when an attacker already possesses initial access rights. The vulnerability was discovered and patched in 2024, yet exploitation activity has now prompted federal action. NIST rates the issue at CVSS 5.5 Medium. U.S. federal agencies are required to apply mitigations by November 18.
Ruby on Rails Releases Security Updates Fixing 21 Vulnerabilities Including Critical Active Storage Flaw
The Ruby on Rails development team has issued security updates for versions 8.1.4.1 and 8.0.5.2 that address a total of 21 vulnerabilities. One issue rated critical affects the Active Storage component when ImageMagick is used for image processing. The flaw tracked as CVE-2026-122006 carries a CVSS v3.1 base score of 9.8 and could allow arbitrary file writes or data exfiltration from untrusted uploads. Additional high-severity problems enable remote code execution, arbitrary file reads, parameter validation bypass, IP spoofing, cross-site scripting, and denial-of-service conditions. The 8.0 branch will reach end of security support on November 7, 2026, after which no further fixes will be provided. Administrators are strongly advised to apply the patches immediately.
European Supermarkets Hit by Refrigeration Cyberattacks Exploiting Danfoss CVEs
Multiple European supermarket chains suffered coordinated cyberattacks that remotely altered refrigeration unit temperatures to 50°C, causing widespread food spoilage across France, Sweden, Ireland, Belgium, Luxembourg, and Estonia. Attackers exploited publicly disclosed vulnerabilities in Danfoss AK-SM 800A controllers, including a code-of-the-day authentication bypass and command injection flaws tracked as CVE-2025-41450 and CVE-2025-41451. The incidents, occurring in October and November, resulted in millions of euros in losses with no ransom demands observed. Claroty researchers had previously mapped thousands of exposed management interfaces running outdated firmware. Investigations by ANSSI and national authorities highlight risks to cyber-physical systems where configuration changes produce direct physical damage. Experts recommend immediate network segmentation, firmware updates, and enhanced monitoring of setpoint changes.
Negative Specifications: How Bug History Strengthens AI Agent Code for Ginux Kernel
The article explores how incomplete positive specifications lead to vulnerabilities and compatibility gaps when AI agents develop complex systems like the Ginux kernel. Author sgordey describes discovering memory limit bypasses, domain controller takeover via infinite loops, and ineffective SO_REUSEADDR flags during security audits of the Rust-written Linux-compatible kernel created by Gregory Kurtzer using HDAE methodology. It argues for building negative specifications drawn from historical vulnerabilities such as SACK Panic and SACK Slowness to define what must never happen and how to test it. The piece details practical integration of past bug data into frameworks including BMAD, OpenSpec, Kiro, and Superpowers, recommending dedicated steps like failure-history and challenge-spec tasks before coding begins. Tools rust-in-peace and reproof already apply similar multi-angle searches combining threat modeling, unaided discovery, and CVE history. The author stresses that requirements derived from real failures must enter both specifications and test plans to prevent agents from repeating known mistakes.