From f42cae636b3853b0700f26522cda98e7990d22ce Mon Sep 17 00:00:00 2001 From: Dan Zucker Date: Wed, 16 Sep 2026 18:06:35 -0700 Subject: [PATCH] Fix W-23401767 security issue regarding debug environment variable. --- website/docs/debug/trex_debugging.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/website/docs/debug/trex_debugging.md b/website/docs/debug/trex_debugging.md index 5da05c58..bd8ea1e1 100644 --- a/website/docs/debug/trex_debugging.md +++ b/website/docs/debug/trex_debugging.md @@ -74,6 +74,12 @@ The remote debugging port (for example, `8696`) must match the port address you ::: +:::important + +If using the `QTWEBENGINE_REMOTE_DEBUGGING` environment variable to enable remote debugging, **unset it when done**. Leaving this variable set allows unauthenticated remote access to your extension’s runtime, creating a remote code execution vulnerability. + +::: + --- #### Optional - Create a Tableau shortcut for debugging (Windows)