Blinko CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH Blinko CVE published 2026-10-12

CVE-2026-108980

CVE-2026-108980 is a high-severity vulnerability in Blinko version 1.8.8 and earlier. An authenticated user can exploit this vulnerability to achieve remote code execution as root via directory traversal and overwriting startup files. The vulnerability is caused by the unsanitized name used to build the plugin install path in server/routerTrpc/plugin.ts, allowing an attacker to install a plugin with a mal [truncated]