RStudio / Posit OSS

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Latest advisories Loading the feed Overview Posit's open-source stack is the working environment for statistical computing: the RStudio IDE, Shiny for R and Python web apps, Quarto for reproducible publishing, and Positron. RStudio Server is the piece that matters. It is a multi-tenant web application whose entire purpose is executing arbitrary user code, and it is the default analytics IDE across pharmaceutical companies running FDA-submission workflows, insurers, banks and quantitative university departments. Session isolation escape or cross-user file access there lands straight on regulated data. Posit publishes a proper PSIRT with a PGP key and states on the same page that it does not offer a bug bounty program. sorona.xyz pays you directly on qualified, reproduced findings. In scope The published policy asks for a report on a vulnerability in any Posit product, by email with PGP or through a repository advisory, and draws no boundary narrower than the product set. This card covers the open-source four: the RStudio IDE, Shiny, Quarto and Positron RStudio Server in full: the HTTP server, the sign-in flow, session cookies and CSRF protection, and the authorisation checks in front of every endpoint The rsession process model and the boundary between a user's session and the server process that launched it, including how a session is spawned, which identity it runs as, and what it inherits Cross-user isolation on a shared server: file access, project handling, session listing and anything else where one account's request can name another account's resource The RStudio IDE front end, covering rendered R output, Markdown and notebook previews, the built-in viewer pane, and every place server-supplied content becomes HTML The RStudio file surface: upload, download, the file browser, the terminal, and the R console itself Shiny end to end, in both the R and Python implementations: the WebSocket protocol between browser and server, input coercion into R or Python evaluation contexts, reactive state, file upload and download handlers, bookmarking and session state The Shiny UI layer, including every place user input reaches rendered HTML, and the static asset handling behind an app Quarto in full: .qmd parsing, the Pandoc invocation, the embedded execution engines for knitr and Jupyter, project and metadata YAML handling, extensions, and the shipped output templates Positron, its extension host and the parts inherited from an editor architecture that loads and runs extension code The R and Python package installation and dependency resolution paths any of these tools trigger on a user's behalf Out of scope Posit Workbench, Connect, Package Manager and Posit Cloud, which are commercial products rather than the open-source four this card covers. They route to the same PSIRT R itself, Pandoc, Electron, Node and the other upstream components these products embed, unless Posit's own use of them is what makes the bug reachable A user running code in their own R or Python session, which is what the products are for. The finding has to cross a user, tenant or privilege boundary A server an administrator deliberately configured without authentication or with shared accounts Third-party Shiny modules, Quarto extensions and Positron extensions the project does not maintain Anything requiring privacy violation or service disruption to demonstrate, which the disclosure guidelines rule out Most-valued findings Session isolation escape on RStudio Server, where one user's session reaches another user's process, files or credentials. This is the crown jewel on this target and the deployments that carry it hold clinical trial and financial data Authentication bypass on RStudio Server, including defects in the sign-in flow, session cookie handling or the proxy-authentication configurations that large institutions run in front of it Cross-user file access through any endpoint that takes a path, on a server where every user's home directory sits on the same machine Privilege escalation from a signed-in user to the server process or to root, given that the server spawns sessions under user identities and must drop privilege correctly to do it Injection from Shiny client input into an R or Python evaluation context, the single most valuable class in Shiny because an app's whole design is turning browser events into server-side evaluation Cross-site scripting in the RStudio IDE or in Shiny UI output that chains into execution, since both run beside an interpreter that already executes arbitrary code Execution during a Quarto render of a document from an untrusted source, through the embedded engines, an extension or the Pandoc invocation. Publishing pipelines render other people's documents unattended Anything in Positron's extension host that lets extension-supplied content escape into the host process Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report to [email protected] , the address the product-security page publishes, and encrypt with the PGP public key printed inline on that page GitHub private vulnerability reporting is enabled on rstudio/rstudio , rstudio/shiny , quarto-dev/quarto-cli and posit-dev/positron , so a repository advisory also works for the open-source products Posit's guidelines are standard responsible disclosure: notify first, do not violate anyone's privacy, do not disrupt a running service Say which product and which edition. RStudio Desktop and RStudio Server are different threat models, and Workbench, Connect and Package Manager are commercial products that route to the same address For anything on RStudio Server, state the authentication method the target used and whether the finding crosses a user boundary. That distinction is the whole value of the report Posit fixes are frequently announced through Workbench and Connect release notes rather than repository advisories, so do not assume a silent repository means the report went nowhere The page states that Posit does not offer a Bug Bounty program. There is no payment to negotiate and no reward terms to accept Disclosure Coordinated privately with a corporate product security team over [email protected] or a GitHub advisory, with an inline PGP key for the email route. Posit publishes fixes through product release notes and security bulletins more often than through repository advisories, so the visible GitHub trail understates what actually gets fixed. Expect the embargo to run to a patched release across the affected products, and confirm with the team where the eventual advisory will appear so the finding is attributable. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability