brain0 v0.1.3

Security

GHSA-8vg9-5mf9-5c84: path traversal in /api/diff (all releases up to 0.1.2). The local server joined the ref query parameter onto the payload directory without validating it, so a crafted ref such as aa/../../secret read any .blob file the user could read. The server also answered every API route with Access-Control-Allow-Origin: * and accepted any Host. As a result, any web page open while brain0 up was running could read the graph, node details and diffs, and could start smart-chat queries, which are paid when a remote LLM is configured.

0.1.3:

• accepts a payload ref only as a BLAKE3 digest (64 lowercase hex chars), both in the TypeScript reader and in the Rust payload stores (read and shred);
• sends no CORS headers;
• requires a loopback Host (localhost, 127.0.0.1, [::1]), against DNS rebinding;
• refuses cross-site browser requests on /graph.json, /health and /api/*;
• requires an x-brain0-ask header on /api/debug, which the GUI sends.

Thanks to Sithum Shihara (zaara2004) for reporting the path traversal.

Hardening

These fixes concern an index brought in from elsewhere, for example a .brain0/index.db committed to a cloned repository:

• the store id is used as the key-directory name only if it has the shape brain0 creates (32 hex chars);
• the GUI escapes timestamps it cannot parse instead of inserting them as HTML.

Fixes

• When attest was the first command run after upgrading to 0.1.2, only attest.key left .brain0/. Now every command moves all legacy keys. A --key-file that doesn't exist, for an index that already has a payload key, is now an error instead of a new key that would leave the payload unreadable.

Upgrade: npx brain0@latest up

Full Changelog: v0.1.2...v0.1.3