Skip to content

fix: address high-risk code execution and path traversal - #432

Merged
luyaxi merged 1 commit into
OpenBMB:mainfrom
waterkokoro:security/high-risk-vulnerability-fixes
Jul 31, 2026
Merged

fix: address high-risk code execution and path traversal#432
luyaxi merged 1 commit into
OpenBMB:mainfrom
waterkokoro:security/high-risk-vulnerability-fixes

Conversation

@waterkokoro

@waterkokoro waterkokoro commented Jul 31, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • ignore the local vulnerability-report docs/ directory
  • prevent ToolServer upload/download paths from escaping the workspace
  • prevent workspace file reads and community archive extraction from escaping interaction storage
  • scope workspace file access to the owning user
  • remove the unauthenticated runtime Python tool-registration endpoint

Fixes #415
Fixes #427
Fixes #429
Fixes #430
Fixes #431

Verification

  • python3 -m pytest tests/test_security_regressions.py -q (4 passed)
  • compiled all modified Python modules with compileall

pengyue.li @cursoragent
fix: address high-risk code execution and path traversal
860643a 
Co-authored-by: Cursor <cursoragent@cursor.com>
@luyaxi
luyaxi merged commit 26f2b6e into OpenBMB:main Jul 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment