Fluxion v6.39

Security

• Fix root remote command execution via a crafted Wi-Fi SSID (GHSA-6c8p-733f-gmp8).
  The scanner decoded airodump-ng ESSID fields through eval after incomplete
  sanitization, letting an attacker-controlled SSID run shell commands as root
  during a routine scan -- before any target was selected. The eval decode is
  replaced with printf -v %b, and the Captive Portal paths that interpolate the
  same ESSID (sed template, cowpatty/airbase-ng command strings, generated
  filenames) are hardened. Adds regression suites for the affected sinks.
  All users should update. Reported by Umut SEVINC (VulnSVNC).

Features

• Split-band deauth / evil-twin support and related reliability fixes (#1256)
• Targeted client deauthentication and a station-aware authenticator (#1255)
• Deauth method selection is now its own Captive Portal step (#1253)

Fixes

• Fix interface allocation infinite loop and NetworkManager conflicts (#1252)
• Improve auto-mode deauth reliability (#1250)
• Fix test(1) operator collisions and unquoted command substitution (#1254)

Project

• Add SECURITY.md with a private vulnerability reporting policy