
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
fetch
compatible syntaxHow can you build a web app that runs on your own device, without uploading data to the cloud?
With SyftBox, you can:
Install with uv and create your app:
uvx fastsyftbox version
uvx fastsyftbox create app test
To start in hot-reloading more:
cd test
./run.sh
This generates a sample FastAPI app in app.py
:
app = FastSyftBox(
app_name=app_name,
syftbox_endpoint_tags=[
"syftbox"
], # endpoints with this tag are also available via Syft RPC
include_syft_openapi=True, # Create OpenAPI endpoints for syft-rpc routes
)
# normal fastapi
@app.get("/", response_class=HTMLResponse)
def root():
return HTMLResponse("<html><body><h1>Welcome to {app_name}</h1>")
# build a model with pydantic
class MessageModel(BaseModel):
message: str
name: str | None = None
# make syftbox rpc endpoints easily
# syft://{datasite}/app_data/{app_name}/rpc/hello
@app.post("/hello", tags=["syftbox"])
def hello_handler(request: MessageModel):
print("got request", request)
response = MessageModel(message=f"Hi {request.name}", name="Bob")
return response.model_dump_json()
# Debug your RPC endpoints in the browser
app.enable_debug_tool(
endpoint="/hello",
example_request=str(MessageModel(message="Hello!", name="Alice").model_dump_json()),
publish=True,
)
Vanilla JS fetch:
const url = "http://somewebsite.com/api"
const request = await fetch(url, {
method: 'POST',
headers,
body
});
Becomes syftFetch:
const syftUrl = "syft://madhava@openmined.org/app_data/fastsyftbox/rpc/hello"
const request = await syftFetch(syftUrl, {
method: 'POST',
headers,
body
});
Under the hood:
syft-x
headers
SyftBox is a new platform for building privacy-preserving applications and experiences that work over the internet without uploading your data. Instead of sending your data to a server, SyftBox lets you run powerful AI and analytics locally or in trusted environments, so your personal information stays private and secure.
Add any Python dependencies to requirements.txt
and run.sh
will install them fresh every run.
Its like Postman but for SyftBox RPC.
A built-in HTML/JS tool helps you debug your HTTP over RPC endpoints. To enable:
app.enable_debug_tool(
endpoint="/hello",
example_request=str(MessageModel(message="Hello!", name="Alice").model_dump_json()),
publish=True,
)
Then visit either: http://localhost:${SYFTBOX_ASSIGNED_PORT}/rpc-debug or if you have publish=True https://syftbox.net/datasites/{{ email }}/public/{{ app_name }}/rpc-debug.html
syftbox app install GITHUB_URL
This executes run.sh and binds your app to a random port: http://localhost:${SYFTBOX_ASSIGNED_PORT}
fastsyftbox
AppsFAQs
FastAPI + SyftBox
We found that fastsyftbox demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.