Skip to content

v0.0.2 — Security Fix for Dangling Symlink Escape (CWE-59)

Latest

Choose a tag to compare

@anshupriyan anshupriyan released this 31 Aug 13:35

What's Changed

  • Security Fix: Hardened resolveSafePath() against dangling-symlink write escapes (CWE-59) by validating unresolved paths with fs.lstatSync() and enforcing fail-closed ancestor verification.
  • Filesystem Handling: Added nearest-existing-ancestor resolution to support legitimate nested new file/directory creation for write_file.
  • Documentation: Added clear configuration placeholders for Claude Desktop and Qwen Studio in README.md.

Special thanks to @0xRomSec for discovering, responsibly reporting, and helping verify this security fix!