
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
github.com/titpetric/task-ui
Run your Taskfile.yml
from the browser.
Start the Docker image with task docker:run
.
Task UI is meant for Docker environments. A generic Dockerfile exists, which
bundles typical dependencies like task
, ttyrec
, docker
, docker compose
.
To use, start by navigating to the docker subfolder. It contains a Taskfile, with the typical commands to build and run task-ui from a Docker image. For examples with Taskfiles you could run, look into the folder examples.
The layout is somewhat responsive, supporting mobile.
To set up your project to run with Task UI, it's recommended you use the example Docker Compose setup here:
services:
runner:
image: titpetric/task-ui
restart: always
build: .
command:
- --history-enable
ports:
- 3000:3000
volumes:
- $PWD/app:/app
- /var/run/docker.sock:/var/run/docker.sock:ro
In particular, you should mount your /app
folder which contains your
Taskfile.yml
, docker-compose.yml
and other files. Task UI will run
with what you provide it with.
command
flags.docker.sock
.The image provides an id_ecdsa
key to use for SSH hops. The recommended
way to deploy is to provide your own docker/root/.ssh
folder with
the SSH keys. You can regenerate the SSH key with task docker:gen
.
task: Available tasks for this project:
Run everything
commands:
Task: fix
Task: install
Task: test
Test task-ui
commands:
CGO_ENABLED=1 go test -race -count=1 -cover ./...
CGO_ENABLED=0 go test -count=1 -cover ./...
Run task-ui
commands:
task-ui --history-enable
Install task-ui
commands:
CGO_ENABLED=0 go install .
Fix code
dependencies:
deps:goimports
commands:
goimports -w .
go fmt ./...
go vet .
go mod tidy
./README.md.sh > README.md
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.