Skip to content

v1.6.1 — Security Patch

Choose a tag to compare

View all tags
@calintzy calintzy released this 10 Mar 04:43
· 7 commits to master since this release
v1.6.1
b0ba719

Security Fixes (8 vulnerabilities patched)

CRITICAL

  • GraphQL Injection in CLI governance command — switched to parameterized variables

HIGH

  • SSRF Defense in NFT metadata fetch — isAllowedURL() blocks internal networks (localhost, 169.254.x.x, private IPs)
  • API Key Exposure in Ethplorer — error messages now sanitized via sanitizeError()
  • RPC URL Validation — only http/https/ws/wss protocols accepted

MEDIUM

  • CLI NFT Timeout — added AbortSignal.timeout(10000) to prevent hanging
  • Error Sanitization — propagated sanitizeError() to all 22 tool files
  • DefiLlama Slug Validation — alphanumeric + hyphen only via isValidSlug()
  • Honeypot Address Validation — pre-validated with isValidAddress()

Files Changed

  • 28 files modified (+129/-56 lines)
  • New security utilities in validate.ts: isAllowedURL(), isValidSlug(), isValidRpcUrl()

Full Changelog: v1.6.0...v1.6.1

Assets 2
Loading