These versions are currently being supported with security updates.
| Version | Supported |
|---|---|
| 3.x | ✅ |
| 2.x | ✅ |
| < 2.0 | ❌ |
To report a security vulnerability, please do not open an issue, as this notifies attackers of the vulnerability. Instead, please email fengmk2 to disclose.
We thank the following security researchers for responsibly disclosing vulnerabilities and helping make Egg.js more secure.
| Researcher | Vulnerability | Fixes |
|---|---|---|
| Y4tacker | Command injection via escapeShellArg in @eggjs/security |
4.x, 3.x |