YApi abandoned since 2022: critical vulnerabilities found and fixed

The popular API documentation platform YApi, with over 27,000 stars on GitHub, has not been updated since 2022. This has led to serious issues, including incompatibility with modern Node.js versions, broken Chrome extensions, and critical security vulnerabilities. Specifically, it was discovered that without a configured passsalt, project tokens are encrypted with a well-known key, allowing project members to impersonate other users. Furthermore, mock scripts allowed for arbitrary code execution on the server. The author has taken over project maintenance, implementing fixes such as an isolated-vm sandbox for secure script execution, updating the extension to Manifest V3, and correcting token logic while maintaining backward compatibility. These updates breathe new life into the tool, ensuring its relevance and security for developers who rely on YApi in their workflows.