biscuit-auth — Vulnerabilities & Security Advisories 4

Biscuit-auth is an authorization library designed for decentralized systems, enabling fine-grained access control through token-based policies. Historically, it has been susceptible to multiple remote code execution (RCE) vulnerabilities, cross-site scripting (XSS), and privilege escalation flaws, primarily stemming from insecure deserialization and improper input validation. The library has accumulated four CVEs to date, highlighting recurring issues in its token parsing and execution engine. While no major public incidents have been documented, the consistent pattern of vulnerabilities suggests potential risks in environments where untrusted tokens are processed. Implementations should prioritize strict input sanitization and consider sandboxing the token execution environment to mitigate these threats.