Venueless vulnerabilities

The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set.

A user with 'update world' permission in any Venueless world can exfiltrate chat messages from direct messages or channels in other worlds on the same server due to a bug in the reporting feature. Exploitation requires knowledge of the internal channel UUID.

A vulnerability in the venueless system allows a user with API access and 'manage users' permission in any world to trigger deletion of user accounts in other worlds.