Tapilot 开源了 📱
不连接电脑，直接打字或说出任务，让 AI 看屏幕操作安卓手机。
基于 Midscene，无需 ADB 或 root，执行过程可回放。也有 Skill／Codex 插件。
源码：tapilot-ai/tapilot
官网：tapilot.lifeos.md
终于开源了，拖延了好久 @dingyi 😄 t.co
10 likes · 1,033 views
CVE-2026-61782: CVE-2026-61782: Sensitive Information Disclosure and Source Code Exfiltration via Insecure HTTP Server…
CVE-2026-61782: Sensitive Information Disclosure and Source Code Exfiltration via Insecure HTTP Server Defaults in @rsdoctor/rspack-plugin
> Vulnerability ID: CVE-2026-61782
> CVSS Score: 7.5
> Published: 2026-09-24
An insecure configuration in the diagnostic HTTP server of @rsdoctor/rspack-plugin allowed unauthenticated remote attackers or malicious local websites to retrieve serialized build metadata and full source code modules.
TL;DR
An insecure default binding (0.0.0.0) combined with wildcard CORS headers in the @rsdoctor/rspack-plugin allowed unauthorized source code retrieval via cross-origin or local network requests.
---
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-200
- Attack Vector: Network (AV:N)
- CVSS v3.1 Score: 7.5 (High)
- Exploit Status: Proof of Concept
- Impact: Confidentiality: High
- CISA KEV Status: Not Listed
Affected Systems
- @rsdoctor/rspack-plugin prior to 1.5.16
- @rsdoctor/rspack-plugin: < 1.5.16 (Fixed in: 1.5.16)
Code Analysis
Commit: 602eb30
fix: restrict server host binding to 127.0.0.1 and implement safe origins
Commit: e9aaef2
fix: secure local websocket validation using randomized handshake tokens
Mitigation Strategies
- Upgrade @rsdoctor/rspack-plugin to version 1.5.16 or higher
- Run builds with CI=true environment variable to suppress diagnostic server creation
- Configure firewall rules to block unsolicited incoming traffic on workstation development ports
Remediation Steps:
1. Verify currently installed version of @rsdoctor/rspack-plugin in package.json or lockfile
2. Execute dependency upgrade command: pnpm add -D @rsdoctor/rspack-plugin@1.5.16 or npm install --save-dev @rsdoctor/rspack-plugin@1.5.16
3. Verify host binding of the diagnostic server is restricted to 127.0.0.1
4. Ensure Host header and CORS origin validation are active in local configuration
References
- GitHub Security Advisory GHSA-jmg2-rcxh-w8q3
- CVE-2026-61782 CVE Record
---
Read the full report for CVE-2026-61782 on our website for more details including interactive diagrams and full exploit analysis.
@jiahan_c Almost time to delete one of our Canva custom loaders 🔥
rspack#14983
3 likes · 31 views
@BleedingDev yes , modern.js#9032 just start
2 likes · 30 views
I built a voice-controlled Android app—even WeChat works
I built a voice-controlled Android app powered by Midscene—even WeChat works.
No ADB, developer mode or USB cable. Wireless Codex control too. See it in action 👇
I plan to open-source the app. Follow for updates!
Built with Midscene, the open-source UI automation framework. Give their repo a star:
web-infra-dev/midscene
1 point · 1 comment
一句话操控安卓手机的 demo
底层是这个开源项目
Midscene，1.5 万 star
字节 web-infra-dev 在维护，MIT 协议
纯视觉操作界面，像人一样看屏幕
不用写元素选择器
Android、iOS、鸿蒙、桌面通吃
AndroidWorld 93.1%
web-infra-dev/midscene
17 likes · 1 repost · 919 views
Child chunks can now reuse more modules already available from their parents, while preserving loading behavior.
PR details 👇
rspack#15885
Child chunks can now reuse more modules already available from their parents, while preserving loading behavior.
👇PR details
rspack#15885
5 likes · 225 views
Testing a toast after it's already gone: a small Midscene example
I work on Midscene. One awkward UI test: submit a form, then check the success toast. By the time the check runs, the toast may already be gone.
Midscene has startObserving() for this. Start recording before the action, stop afterward, and run the assertion against the recorded frames:
const observer = await agent.startObserving();
await agent.aiAct('submit the form');
const observation = await observer.stop();
await observation.aiAssert('a success toast appeared during the process');
await observation.dispose();
The same approach is useful for banners and page transitions. It samples the screen, so a very brief event can still be missed; this isn't a frame-perfect game recorder.
Midscene is open source. Model calls have their own cost.
Docs: midscenejs.com
Source: web-infra-dev/midscene
What transient UI would you want to test this way?
1 comment
Mentions
Tapilot 开源了 📱 不连接电脑，直接打字或说出任务，让 AI 看屏幕操作安卓手机。 基于 Midscene，无需 ADB 或 root，执行过程可回放。也有 Skill／Codex 插件。 源码：tapilot-ai/tapilot 官网：tapilot.lifeos.md 终于开源了，拖延了好久 @dingyi 😄 t.co
CVE-2026-61782: CVE-2026-61782: Sensitive Information Disclosure and Source Code Exfiltration via Insecure HTTP Server… CVE-2026-61782: Sensitive Information Disclosure and Source Code Exfiltration via Insecure HTTP Server Defaults in @rsdoctor/rspack-plugin > Vulnerability ID: CVE-2026-61782 > CVSS Score: 7.5 > Published: 2026-09-24 An insecure configuration in the diagnostic HTTP server of @rsdoctor/rspack-plugin allowed unauthenticated remote attackers or malicious local websites to retrieve serialized build metadata and full source code modules. TL;DR An insecure default binding (0.0.0.0) combined with wildcard CORS headers in the @rsdoctor/rspack-plugin allowed unauthorized source code retrieval via cross-origin or local network requests. --- ⚠️ Exploit Status: POC Technical Details - CWE ID: CWE-200 - Attack Vector: Network (AV:N) - CVSS v3.1 Score: 7.5 (High) - Exploit Status: Proof of Concept - Impact: Confidentiality: High - CISA KEV Status: Not Listed Affected Systems - @rsdoctor/rspack-plugin prior to 1.5.16 - @rsdoctor/rspack-plugin: < 1.5.16 (Fixed in: 1.5.16) Code Analysis Commit: 602eb30 fix: restrict server host binding to 127.0.0.1 and implement safe origins Commit: e9aaef2 fix: secure local websocket validation using randomized handshake tokens Mitigation Strategies - Upgrade @rsdoctor/rspack-plugin to version 1.5.16 or higher - Run builds with CI=true environment variable to suppress diagnostic server creation - Configure firewall rules to block unsolicited incoming traffic on workstation development ports Remediation Steps: 1. Verify currently installed version of @rsdoctor/rspack-plugin in package.json or lockfile 2. Execute dependency upgrade command: pnpm add -D @rsdoctor/rspack-plugin@1.5.16 or npm install --save-dev @rsdoctor/rspack-plugin@1.5.16 3. Verify host binding of the diagnostic server is restricted to 127.0.0.1 4. Ensure Host header and CORS origin validation are active in local configuration References - GitHub Security Advisory GHSA-jmg2-rcxh-w8q3 - CVE-2026-61782 CVE Record --- Read the full report for CVE-2026-61782 on our website for more details including interactive diagrams and full exploit analysis.
@jiahan_c Almost time to delete one of our Canva custom loaders 🔥 rspack#14983
@BleedingDev yes , modern.js#9032 just start
I built a voice-controlled Android app—even WeChat works I built a voice-controlled Android app powered by Midscene—even WeChat works. No ADB, developer mode or USB cable. Wireless Codex control too. See it in action 👇 I plan to open-source the app. Follow for updates! Built with Midscene, the open-source UI automation framework. Give their repo a star: web-infra-dev/midscene
一句话操控安卓手机的 demo 底层是这个开源项目 Midscene，1.5 万 star 字节 web-infra-dev 在维护，MIT 协议 纯视觉操作界面，像人一样看屏幕 不用写元素选择器 Android、iOS、鸿蒙、桌面通吃 AndroidWorld 93.1% web-infra-dev/midscene
Child chunks can now reuse more modules already available from their parents, while preserving loading behavior. PR details 👇 rspack#15885
Child chunks can now reuse more modules already available from their parents, while preserving loading behavior. 👇PR details rspack#15885
Testing a toast after it's already gone: a small Midscene example I work on Midscene. One awkward UI test: submit a form, then check the success toast. By the time the check runs, the toast may already be gone. Midscene has startObserving() for this. Start recording before the action, stop afterward, and run the assertion against the recorded frames: const observer = await agent.startObserving(); await agent.aiAct('submit the form'); const observation = await observer.stop(); await observation.aiAssert('a success toast appeared during the process'); await observation.dispose(); The same approach is useful for banners and page transitions. It samples the screen, so a very brief event can still be missed; this isn't a frame-perfect game recorder. Midscene is open source. Model calls have their own cost. Docs: midscenejs.com Source: web-infra-dev/midscene What transient UI would you want to test this way?