---
title: "15.14.2: Reliability and security patch: <base> tag, cy.wait(), and simple-git RCE"
url: "https://www.cypress.io/releases/15-14-2"
description: "Apps using <base target=\"_top\"> or <base target=\"_parent\"> no longer escape the Cypress iframe during test runs. This release also fixes a cy.wait() teardown…"
---

# 15.14.2: Reliability and security patch: <base> tag, cy.wait(), and simple-git RCE

ReleasedReleased on April 28, 2026

Apps using <base target="\_top"> or <base target="\_parent"> no longer escape the Cypress iframe during test runs. This release also fixes a cy.wait() teardown crash on multi-alias retries, a config reload race in cypress open, and patches a simple-git Remote Code Execution vulnerability.

[Read the changelog](https://docs.cypress.io/app/references/changelog?utm_source=release-card&utm_medium=cypress.io#15-14-2)