A flaw in the binary-parser npm package before version 2.3.0 lets attackers execute arbitrary JavaScript via unsanitized parser input.
Researchers found an indirect prompt injection flaw in Google Gemini that bypassed Calendar privacy controls and exposed ...