Issues

• RUSTSEC-2026-0368: zip: ZipArchive::extract creates symbolic links whose attacker-controlled targets are outside the destination directory

  railwayapp/cli#1303 · Filter by author github-actions opened on Oct 17, 2026

• RUSTSEC-2026-0367: Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation

  railwayapp/cli#1302 · Filter by author github-actions opened on Oct 17, 2026

• RUSTSEC-2026-0369: ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target

  railwayapp/cli#1301 · Filter by author github-actions opened on Oct 17, 2026

• railway config migrate silently converts Dockerfile builds to Railpack

  railwayapp/cli#1290 · Filter by author actu4l opened on Oct 15, 2026
  1

• config plan plans source → null for a service without source, though the docs say to omit it

  railwayapp/cli#1286 · Filter by author sufyant opened on Oct 14, 2026

• Docs: document build: { builder, dockerfilePath } in the IaC reference

  railwayapp/cli#1285 · Filter by author phenaproxima opened on Oct 14, 2026

• ca bootstrap list/save fail to decode when AgentBootstrap.environmentId is null

  railwayapp/cli#1283 · Filter by author codyde opened on Oct 13, 2026
  

• RUSTSEC-2024-0449: unsafe-libyaml is unmaintained

  railwayapp/cli#1280 · Filter by author github-actions opened on Oct 13, 2026

• railway config planner misses region changes for single-replica services

  railwayapp/cli#1273 · Filter by author jhmckimm opened on Oct 10, 2026
  1

• config plan returns Unauthorized with a project token (RAILWAY_TOKEN) in 5.64.1

  railwayapp/cli#1270 · Filter by author ken-rever opened on Oct 9, 2026
  1

• config apply --confirm-destructive skips a planned bucket deletion and exits 0

  railwayapp/cli#1266 · Filter by author marcospgp opened on Oct 8, 2026

• railway/iac version guard throws on any shell where _ resolves to a Node binary

  railwayapp/cli#1255 · Filter by author Bobnoddle opened on Oct 7, 2026

• Support --json errors on railway ssh, so scripts can tell a signed-out account from other failures

  railwayapp/cli#1244 · Filter by author marcospgp opened on Sep 29, 2026

• railway ssh with piped input fails with "Host key verification failed" on a machine that never connected

  railwayapp/cli#1240 · Filter by author marcospgp opened on Sep 28, 2026

• railway ssh says "No registered SSH keys found" when the account has keys but none match this machine

  railwayapp/cli#1237 · Filter by author marcospgp opened on Sep 25, 2026

• railway volume add --service <name> panics; volume subcommands don't resolve service names

  railwayapp/cli#1231 · Filter by author Aspireco opened on Sep 23, 2026
  1

• railway logs --help: intermittent SIGABRT, correlates with background update-check timing

  railwayapp/cli#1225 · Filter by author capacitron opened on Sep 21, 2026

• config migrate omits databases/volumes and cannot map CaC files to services in a monorepo

  railwayapp/cli#1224 · Filter by author jticona-pm opened on Sep 21, 2026

• Indicate whether a variable value is a reference (${{...}}) or a static copy

  railwayapp/cli#1223 · Filter by author mkucharz opened on Sep 20, 2026

• railway config migrate silently drops dockerfilePath/builder/restart-policy/region, duplicate key in TS output

  railwayapp/cli#1199 · Filter by author jourlez opened on Sep 12, 2026
  3

• IaC: define and manage shared variables from railway.ts

  railwayapp/cli#1191 · Filter by author rkm3 opened on Sep 10, 2026
  1

• IaC: declare named environments in railway.ts (Wrangler-style overlays)

  railwayapp/cli#1190 · Filter by author rkm3 opened on Sep 10, 2026
  1

• IaC plan cannot converge default ON_FAILURE restart policy

  railwayapp/cli#1184 · Filter by author nick-fanrock opened on Sep 9, 2026
  1

• config apply exits 0 and prints nothing when the change-set workflow fails (e.g. duplicate database name)

  railwayapp/cli#1170 · Filter by author guilhermeyoshida opened on Sep 5, 2026
  1

• gh attestation verify fails for v5.45.8 Windows release (both --repo and --owner policies)

  railwayapp/cli#1154 · Filter by author zer0-kn0wledge opened on Aug 29, 2026