If you have discovered a security vulnerability in this project, please report it privately. Do not disclose it as a public issue. This gives us time to work with you to fix the issue before public exposure, reducing the chance that the exploit will be used before a patch is released.

Please disclose it at security advisory.

This project is maintained by a team of volunteers on a reasonable-effort basis. As such, please give us at least 90 days to work on a fix before public exposure.

A PAC file is a program. Pacparser runs it in an embedded JavaScript engine (QuickJS) and does not sandbox it. Only load PAC files you trust, just as you would only run scripts you trust. Pacparser is not designed to safely evaluate PAC files supplied by an attacker.

Issues that an attacker can trigger against a typical use of pacparser without controlling the PAC file: for example, memory corruption in pacparser's own code (src/pacparser.c, pactester, or the Python module) caused by a crafted URL or host name passed to a trusted PAC file.

Reports about the following will be closed without a fix, security advisory, CVE, or credit:

• Any issue that requires the attacker to supply or modify the PAC file, including memory corruption, crashes, hangs, or excessive resource use in the JavaScript engine.
• Bugs in QuickJS itself. Please report those to the upstream QuickJS project. Pacparser picks up upstream fixes when it updates its vendored copy.
• Issues that require a malicious or nonsensical value from the embedding application or the command line (for example, through pacparser_setmyip() or pactester options).
• Build-time and install-time issues, including ones that rely on files planted on the build machine.
• Local-only issues, and issues that depend on the victim taking unusual or unsafe actions.
• Issues in build scripts, CI configuration, test code, or examples.
• Reports generated by automated scanners, fuzzers, or AI agents, unless a person has verified a realistic attack against a typical use of pacparser.

Reporters who repeatedly send out-of-scope reports may be blocked.

Non-security bug fixes and hardening suggestions are welcome as regular issues or pull requests.