Unverified50% confidenceFactExact time
The vulnerability is caused by incomplete coverage of the three-layer protection for HTML previews (CSP, data: URL isolation, and dev-server proxy filtering): files smaller than 256KB are loaded via data: URL and protected by CSP, while files larger than 256KB are written to a temporary file and loaded via the file:// protocol, a path that has neither CSP nor request filtering.
1
Sources
50%
Confidence
Long-term
Relevance
10/18/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedCSP (Content Security Policy) is an HTTP security header that defends against cross-site scripting (XSS) and data injection attacks through a whitelist mechanism.68% similarUnverified网页端受CORS、内容安全策略CSP和WebAssembly沙盒等浏览器安全策略约束68% similarUnverifiedApplication password authentication depends on the site enabling HTTPS; in a pure HTTP environment WordPress will refuse to generate it; some security plugins (such as Wordfence) block the REST API by default or add extra interception to application password authentication, causing requests to fail with error messages pointing in unrelated directions.61% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1061011API
curl https://kongchang.com/api/v1/knowledge/claims/1061011MCP
get_claim(id=1061011)