v0.9.3 — Security Campaign & CI Fixes

v0.9.3 — 2026-08-29

Security (14 commits)

Full CodeQL remediation across 20+ files:

• 40+ alerts resolved — py/path-injection, py/stack-trace-exposure, py/code-injection, js/xss-through-dom, js/incomplete-sanitization
• Hardcoded secrets removed — Flask secret_key and encryption salt now use uuid.uuid4().hex
• Info-leak eradication — all str(e) / str(exc) in API responses replaced with generic messages + server-side logging.exception()
• Path traversal hardening — _safe_write() and _secure_path() use basename extraction + containment checks
• Browser engine — download path validated within home directory with fallback to ~/Downloads
• JS syntax — repaired router.ts bracket placement; recompiled valid JS

Infrastructure

• llama Dockerfile — switched to CPU-only ubuntu:24.04, fixing pre-existing CI build failure
• memory_primitives restored — orphaned unregistered submodule converted to proper in-repo package with rewritten aggregate tests (18 tests)

UI

• Sidebar collapse animation — CSS transitions for smooth width/padding and main content grid behavior

Test Results

• 943 tests passing (925 main + 18 aggregate)
• 0 open error-severity CodeQL alerts
• All CI pipelines green (ci, CodeQL Advanced, docker-publish, Workflow CI)

v1.10.0 — Real NVD CVE Data for All Exploit Skills

Update

v1.9.0 — Real NVD CVE API Integration

New Features

v1.8.0 — Exploit Category Skills with Real API Routes

New Features

v1.7.0 — Chained Zero-Day & Memory Corruption Primitives

New Exploit Category Skills (2)\n\n### Chained Zero-Day Exploitation\n- Multi-stage attack chain simulation (4 stages: initial access → priv esc → persistence → exfil)\n- Real-world chains: Pegasus (CVE-2019-8641→8646→8647), FORCEDENTRY, BLASTPASS\n- AI-assisted chain optimization and viability scoring\n- Chain visualization and dependency analysis\n- 7 backend routes, 14 tests\n\n### Memory Corruption Primitives\n- 10 primitives: buffer overflow, UAF, double-free, heap overflow, format string, integer overflow, OOB read/write, type confusion, TOCTOU, null deref\n- Primitive-to-exploit mapping with real-world CVEs\n- Mitigation techniques and defense-in-depth analysis\n- AI-assisted primitive selection and gadget discovery\n- 7 backend routes, 20 tests\n\n## Stats\n- 63 dashboard templates\n- 410 backend routes\n- 817+ tests passing\n- 8 files changed, 1524 lines added

v1.6.0 — AI Training, Exploit Categories, DDNS & Network Control

New Features

v1.5.0 — 17 New Web Card Dashboards

New Dashboard Pages (17)

v1.4.0 — Zero-Click Exploit Agent Suite

New Skills & Agents (9)

Release v1.3.2

v1.3.2 — Phase 8 Release Engineering

v1.3.1 — Docs Polish & Visual Upgrade

What's New