Back to changelog
Security advisoryv2026.4.1
Closed Impulse injection vector via NUI iframe
Impulse menu was loading an injection payload through a hidden NUI iframe; that vector is now blocked at the client layer with a server-side trace fallback.
What we shipped
- NUI iframe sources now whitelisted; foreign sources blocked + reported
- Server-side trace fallback runs even if the client check is bypassed
- Documented the vector in the public security-advisory feed
Advisory metadata
Reported by: Independent security researcher (credited in advisory)
Affected before: v2026.4.0