Skip to content

v0.3.1 — security release

Latest
Latest

Choose a tag to compare

View all tags
@canuto canuto released this 13 Aug 09:42
· 2 commits to main since this release
v0.3.1
e3992a5
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security release. Anyone running ghcr.io/restdb/codehooks-mcp:latest or earlier tags should upgrade.

Fixed

Path traversal → arbitrary host file write in deploy_code (GHSA-hqg5-rc57-rr9p)

High severity, CVSS 8.1, CWE-22 / CWE-73. Reported by @mcfly-zzh.

deploy_code wrote caller-supplied files[].path via path.join(tmpDir, file.path) with no containment check, so a ..-laden path escaped the staging directory and wrote attacker-controlled content anywhere the server uid could write, creating parent directories along the way. The write happened before the auth-gated coho deploy, so it required no valid Codehooks account or admin token.

Fixed in two layers: the input schema now rejects absolute paths, .. segments, backslash-separated traversal, drive letters and NUL bytes; and the write sink re-validates that the resolved path stays inside the staging directory.

Host code execution via npm lifecycle scripts in deploy_code

Found while fixing the above; not previously reported. The handler merges caller-supplied package.json content into the staged file and then ran npm install, which executes root lifecycle scripts — so control over scripts yielded arbitrary command execution on the host. This was a strictly stronger primitive than the traversal.

npm install now runs with --ignore-scripts. Dependencies resolve identically; the only lifecycle scripts in the codehooks-js tree are prepare hooks that npm does not run for registry tarballs.

Behaviour change: a deploy whose dependency genuinely requires a postinstall (typically native builds) will no longer run it.

Dependency alerts

@modelcontextprotocol/sdk upgraded from a pinned 1.11.0 to ^1.30.0, clearing two open high-severity alerts:

  • GHSA-345p-7cg4-v4c7 — cross-client data leak via shared server/transport instance reuse (patched 1.26.0)
  • GHSA-w48q-cv73-mx4w — DNS rebinding protection not enabled by default (patched 1.24.0)

Neither appears exploitable in this server, which runs one client per process over StdioServerTransport; both concern HTTP/SSE transports and multi-client reuse. npm audit reports 0 vulnerabilities.

Changed

  • Removed a dead CompleteRequestSchema handler that returned a hardcoded placeholder in a non-spec response shape. Newer SDK versions refuse to register handlers whose capability is not advertised, so this caused an immediate startup crash on upgrade. completion/complete now correctly returns method-not-found.
  • Version fields are synced across package.json, server.json and the serverInfo reported over the protocol. These had drifted to 0.1.0, 0.2.8 and 1.0.0 respectively, which is why GHSA-hqg5-rc57-rr9p had to identify affected releases by git tag rather than version.

Upgrading

docker pull ghcr.io/restdb/codehooks-mcp:latest

No configuration or tool-call changes are required. Legitimate deploys, including nested paths, are unaffected.

Full changelog: v0.3.0...v0.3.1

Assets 2
Loading