Skip to content

v1.2.2 — credential scoping and workspace containment

Choose a tag to compare

View all tags
@TheStreamCode TheStreamCode released this 25 Jul 21:51
· 32 commits to main since this release
v1.2.2
301b5e8

Security

  • Credential leak to lookalike domains. isChutesHost matched the asset URL with a bare hostname.endsWith("chutes.ai"), so hosts such as evilchutes.ai satisfied it and the Authorization header — carrying CHUTES_API_KEY — was attached to the download. The asset URL comes from the invoked chute's own response and the server lists public chutes by design, so any third-party chute could harvest the key by returning a crafted URL. The check now requires the apex host or a real subdomain.
  • Arbitrary file read and upload. maybeEncodeFile resolved every non-text string param against the workspace with no containment, so an absolute path or a ../ escape (/etc/passwd, ../../.ssh/id_rsa) was read, base64-encoded and sent to the third-party model. Params come straight from the model, so the value was never user-controlled. Resolved paths must now stay inside the workspace root.
  • Both are covered by regression tests in test/credential-scope.test.ts.

Fixed

  • The server announced version 1.2.0 in the MCP handshake while the package shipped as 1.2.1. The version is now read from package.json instead of being duplicated as a literal.

Users of 1.2.1 and earlier should upgrade. If you ran the server against untrusted public chutes, consider rotating CHUTES_API_KEY.

Full Changelog: v1.2.0...v1.2.2

Assets 2
Loading