Description
After adding private posts (followers, direct) that you do not have permission to view to your favorites or clips, you can export them to view the contents of the private posts.
Recommendation
Update the misskey-js package to the latest compatible version. Followings are version details:
- Affected version(s): >= 13.0.0-beta.16, < 2025.12.0
- Patched version(s): 2025.12.0
References
Related Issues
- Misskey has a login rate limit bypass via spoofed X-Forwarded-For header - CVE-2025-66482
- Bootstrap Multiselect Vulnerable to CSRF and Reflective XSS via Arbitrary POST Data - CVE-2025-47204
- @clerk/backend Performs Insufficient Verification of Data Authenticity - CVE-2025-53548
- [email protected] contains malware after npm account takeover - CVE-2025-59142
You might also like:
- Tags:
- npm
- misskey-js
Anything's wrong? Let us know Last updated on January 06, 2026