Skip to content

v5.15.5 - Security fixes: path traversal, fail-closed network surfaces, Node 18/20 CLI

Choose a tag to compare

View all tags
@Jovancoding Jovancoding released this 17 Oct 18:13
· 6 commits to main since this release
v5.15.5
7977f30

Security

Four privately reported vulnerabilities, all reported by zx (@manus-pi):

  • GHSA-5mm5-4mh4-6gm6 (High, CWE-22): InputSanitizer.sanitizePath() accepted sibling directories that share the base directory's name prefix (/data/project-evil for base /data/project). Containment is now checked on path-segment boundaries; NUL bytes are rejected.
  • GHSA-v64j-mc7x-c7x7 (High, CWE-23): FileJobStore job IDs allowed ../ traversal to read or delete arbitrary .json files.
  • GHSA-mfxv-jg44-xj48 (High, CWE-23): AgentVCR cassette names allowed ../ traversal to read or write arbitrary .json files. Both now use the new InputSanitizer.safeChildPath().
  • GHSA-qvf5-9prv-7r9c (High, CWE-306): A2AServer task routes were unauthenticated when no secret was configured (the default).

Same-class hardening from a follow-up audit:

  • ApprovalInbox (HTTP API) and SwarmTransportServer now require a secret; allowUnauthenticated: true is an explicit, loopback-only opt-out.
  • SwarmTransportServer signatures now cover the request id, source node, timestamp, and TTL, are verified in constant time, and stale or replayed requests are rejected. A listed sourceNode is required when allowedNodes is set.
  • ControlPlane and WorkTreeDashboard gained the GHSA-hr6v-mfxm-4438 Host/Origin checks (DNS rebinding, cross-site WebSocket hijacking).

Breaking changes

  • A2AServer, ApprovalInbox (HTTP), and SwarmTransportServer throw without a non-empty secret. Pass a secret, or allowUnauthenticated: true for loopback-only local development.
  • Swarm transport clients and servers must both run 5.15.5 (the signed payload changed).
  • FileJobStore IDs and AgentVCR cassette names must match [A-Za-z0-9_.-]{1,128} without ..; other values throw SecurityError.

Fixed

  • CodeQL #183 (py/mixed-returns) in scripts/context_manager.py.
  • ClawHub skill 5.15.4 scan follow-up: reworded inject preamble and capability declarations, declared blackboard.py archive writes, moved scan-findings history to SECURITY.md.

Tests

3,738 tests across 41 suites; test-phase20.ts reproduces all four advisory PoCs. Local HOL plugin-scanner: 95/100, no high findings.

Full changelog: v5.15.4...v5.15.5

Contributors

manus-pi
Assets 2
Loading