{"full_name":"PrivateBin/PrivateBin","owner":"PrivateBin","name":"PrivateBin","url":"https://github.com/PrivateBin/PrivateBin","description":"A minimalist, open source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256 bits AES.","homepage":"https://privatebin.info/","topics":[],"language":"PHP","license":"NOASSERTION","avatar":"https://avatars.githubusercontent.com/u/20367028?v=4","created_at":"2016-07-09T07:03:25Z","pushed_at":"2026-11-09T21:04:58Z","metrics":{"stars":8737,"forks":1059,"watchers":106,"issues":950,"prs":957,"releases":45,"issues_open":null,"issues_closed":null,"prs_open":null,"prs_closed":null,"prs_merged":null,"discussions":173},"growth":{"day":{"stars":0,"forks":1,"base_day":"2026-11-09"},"week":{"stars":11,"forks":3,"base_day":"2026-11-03"},"month":{"stars":80,"forks":20,"base_day":"2026-10-11"}},"history":{"dates":["2026-09-06","2026-09-07","2026-09-08","2026-09-09","2026-09-10","2026-09-11","2026-09-12","2026-09-13","2026-09-14","2026-09-15","2026-09-16","2026-09-17","2026-09-18","2026-09-19","2026-09-20","2026-09-21","2026-09-22","2026-09-23","2026-09-24","2026-09-25","2026-09-26","2026-09-27","2026-09-28","2026-09-29","2026-09-30","2026-10-01","2026-10-02","2026-10-03","2026-10-04","2026-10-05","2026-10-06","2026-10-07","2026-10-08","2026-10-09","2026-10-10","2026-10-11","2026-10-12","2026-10-13","2026-10-14","2026-10-15","2026-10-16","2026-10-17","2026-10-18","2026-10-19","2026-10-20","2026-10-21","2026-10-22","2026-10-23","2026-10-24","2026-10-25","2026-10-26","2026-10-27","2026-10-28","2026-10-29","2026-10-30","2026-10-31","2026-11-01","2026-11-02","2026-11-03","2026-11-04","2026-11-09","2026-11-10"],"stars":[8585,8587,8590,8591,8595,8594,8598,8602,8601,8601,8601,8602,8601,8603,8604,8603,8605,8606,8608,8610,8612,8615,8623,8633,8633,8636,8637,8638,8638,8639,8647,8651,8653,8657,8657,8657,8658,8659,8661,8664,8669,8674,8677,8682,8685,8690,8693,8699,8702,8705,8708,8707,8716,8721,8720,8722,8722,8722,8726,8731,8737,8737],"forks":[1031,1031,1031,1031,1032,1031,1032,1033,1031,1031,1031,1033,1033,1033,1034,1034,1034,1035,1035,1036,1036,1038,1038,1038,1037,1038,1038,1038,1038,1039,1039,1039,1039,1040,1039,1039,1039,1039,1040,1039,1038,1038,1039,1040,1042,1045,1048,1050,1051,1052,1053,1056,1055,1056,1057,1056,1056,1056,1056,1057,1058,1059],"watchers":[104,104,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,104,104,104,104,105,105,104,104,105,105,105,106,106,106,106,106,106,106,106],"issues_open":[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null],"prs_open":[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null]},"boards":{},"same_owner":[],"issues":[{"number":245,"title":"Brute-force protection: only download password-protected paste in case the receiver knows the password (implement challenge-response mechanism)","comments":48,"created_at":"2017-09-04T15:07:41Z"},{"number":541,"title":"\"Burn paste\" button for receiver of paste","comments":23,"created_at":"2019-11-12T20:04:18Z"},{"number":658,"title":"Facebook tracking parameter is not rewritten","comments":16,"created_at":"2020-06-25T17:01:30Z"},{"number":234,"title":"raw view link","comments":16,"created_at":"2017-06-11T12:15:52Z"},{"number":514,"title":"Option to Edit English language","comments":15,"created_at":"2019-09-04T23:50:04Z"},{"number":835,"title":"Prettify.js is now abandoned/archived. highlight.js as a replacment?","comments":14,"created_at":"2021-09-24T22:44:49Z"},{"number":1336,"title":"Improve JS (Frontend) unit testing coverage","comments":13,"created_at":"2024-05-14T19:26:18Z"},{"number":460,"title":"[FEATURE] Add support for chacha20-poly1305","comments":13,"created_at":"2019-07-12T09:16:15Z"}],"discussions":[{"number":2123,"title":"Release v2.1.1 - Fix SVG attachment preview, sizelimit circumvention & Markdown attribute vulnerabilities","comments":0,"category":"Announcements","created_at":"2026-11-04T23:20:27Z"},{"number":2112,"title":"Feature: One time ticket service","comments":0,"category":"Ideas","created_at":"2026-10-30T20:29:30Z"},{"number":2089,"title":"PHP CVE-2026-10961/9","comments":1,"category":"Q&A","created_at":"2026-10-23T14:38:31Z"},{"number":2079,"title":"stuck on \"Preparing new document…\" when discussion = false","comments":1,"category":"Q&A","created_at":"2026-10-22T14:28:04Z"},{"number":2076,"title":"What bout PHP CVE-2026-109618 and CVE-2026-109619 ?","comments":2,"category":"Q&A","created_at":"2026-10-22T07:39:15Z"},{"number":2061,"title":"[Bug in 2.1.0 ] Uncaught TypeError in showCreateButtons when discussion = false","comments":1,"category":"General","created_at":"2026-10-19T06:16:12Z"},{"number":2052,"title":"Release v2.1.0 - Removed jQuery and bootstrap 3 template","comments":1,"category":"Announcements","created_at":"2026-10-18T08:38:02Z"},{"number":2051,"title":"What branch to PR a template","comments":2,"category":"Q&A","created_at":"2026-10-18T03:15:41Z"}],"latest_release":{"name":"Release v2.1.1 - Fix SVG attachment preview, sizelimit circumvention & Markdown attribute vulnerabilities","tag":"2.1.1","published_at":"2026-11-04T23:20:26Z","body":"* ADDED: Translation for Korean (#2071)\r\n* ADDED: Comments authenticate the IDs of their document and parent comment if present. Older comments without these IDs are still accepted and shown, unless the new `discussionrequireauthenticatedids` option is enabled to validate these fields (#2101)\r\n* CHANGED: Check `sizelimit` over full request, before attempting decoding\r\n* CHANGED: Database backend now logs errors when reading comments, like it already did for comment existence checks (#2100)\r\n* FIXED: Creating a document failed with a JavaScript error when the `discussion`, `password`, e-mail or QR code option is disabled, as the top navigation accessed the omitted elements\r\n* FIXED: Slovenian plural forms were stored in the wrong order, i.e. \"1 uri\" instead of \"1 ura\" for one hour (#1951)\r\n* FIXED: Lithuanian plural formula selected the \"few\" form for numbers ending in 0 above 10, i.e. \"20 sekundės\" instead of \"20 sekundžių\" (#1956)\r\n* FIXED: new paste button resets it to default formatter/style instead of hardcoding 'plaintext' (#2026)\r\n* FIXED: Comments must now be unique in cipher text within a document, not reuse existing cipher texts (#2100)\r\n* FIXED: Password peek button next to the password input when creating a document had no effect\r\n* FIXED: E-mail button sent several e-mails after being shown again or after its confirmation dialog was dismissed\r\n* FIXED: SVG attachment previews could turn non-ASCII characters into markup after sanitization, enabling script execution when opening the preview in a new tab\r\n* FIXED: SVG attachment previews use a data URL, so they no longer run in the instance's origin when opened in a new tab\r\n* FIXED: Password characters above U+00FF got truncated before key derivation, now passwords get UTF-8 encoded and existing documents remain readable\r\n\r\nThis release addresses issues with SVG attachment preview same-origin, `sizelimit` circumvention allowing DoS attack filling disk & CSS classes and inline styles still not getting stripped from Markdown HTML. More details on these issues can be found in the security advisories:\r\n* [SVG attachment preview runs same-origin script in the PrivateBin client](https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-6vvp-q86m-cp8q)\r\n* [`sizelimit` circumvention allows DoS attack filling disk: Only `ct` is checked while the `adata` array is stored and served unbounded](https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-9rmv-j9gp-6vc5)\r\n* [GHSA-w873-3ghv-hmh6 fix in 2.1.0 is ineffective: USE_PROFILES discards the new ALLOWED_ATTR](https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-c4gc-8mcm-hh65)"},"readme":true,"readme_zh":false,"news":[],"stale":false,"snapshot_at":"2026-11-10T09:35:25Z","history_start":"2026-09-06"}