See how meta compares to other vendors in security performance
A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the FILENAME value used by setfilename() and loadmetadata() in metagpt/ext/spo/utils/load.py. The vulnerable code joins the attacker-controlled FILENAME value with the settings directory and opens the resulting path without validating that the resolved path remains within the intended directory.
An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.rebuildclassviews() in metagpt/repoparser.py.
Impact
It was found that the fix to address CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case.
We recommend updating immediately.
The vulnerability exists in versions 19.0.2, 19.1.3, and 19.2.2 of:
- react-server-dom-webpack - react-server-dom-parcel - react-server-dom-turbopack
These issues are present in the patches published on December 11th, 2025.
Patches
Fixes were back ported to versions 19.0.3, 19.1.4, and 19.2.3.
If you are using any of the above packages please upgrade to any of the fixed versions immediately.
If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.
References
See the blog post for more information and upgrade instructions.
(I'm not affiliated with React nor Meta, just posting this here as I don't think I've seen the team send notes to this list.)
https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
https://www.cve.org/CVERecord?id=CVE-2025-55182
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 of
- react-server-dom-webpack - react-server-dom-parcel - react-server-dom-turbopack
The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
The commit including the fix is here: https://github.com/facebook/react/pull/35277
"Further details of the vulnerability will be provided after the rollout of the fix is complete."
Impact
There is an unauthenticated remote code execution vulnerability in React Server Components.
We recommend upgrading immediately.
The vulnerability is present in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 of: react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack
Patches
A fix was introduced in versions 19.0.1, 19.1.2, and 19.2.1. If you are using any of the above packages please upgrade to any of the fixed versions immediately.
If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.
References
See the blog post for more information and upgrade instructions.
The Meta Display Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Meta Display Block in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.
A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function torch.cuda.nccl.reduce of the file torch/cuda/nccl.py. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The patch is identified as 5827d2061dcb4acd05ac5f8e65d8693a481ba0f5. It is recommended to apply a patch to fix this issue.
Meta recently patched a high-severity vulnerability in WhatsApp for Windows (CVE-2025-30401) that allowed attackers to execute malicious code on a target’s machine by sending spoofed file types. The exploit didn’t require the user to do anything beyond opening what looked like a harmless file. This makes it particularly dangerous for less tech-savvy users and internal teams not trained in threat detection. What is known: \- Affected all WhatsApp for Windows versions prior to 2.2450.6 \- Exploited using specially crafted files with manipulated extensions \- Meta confirmed active exploitation before the patch was issued It’s a reminder that even popular desktop apps can become threat vectors when spoofing and user trust intersect. Were you or someone you know affected by this? Or have you seen this exploited in the wild in an org you work with?