v0.3.14 — Security fix (update recommended)
A security fix. Update if you run the desktop app or a local server.
Fixed (thanks to a sharp-eyed report on Hacker News)
The local server (desktop app and npm run server) had a remote command-execution hole: the PDF renderer passed a request value straight into a shell command, and the server listened on all network interfaces with open CORS. Together, someone on your network — or any website you visited while the app ran — could run commands on your machine. Closed three ways:
- No shell. The subprocess call now uses an argument array (
execFile), so no request value can be read as a command. The one numeric input is clamped to a range as well. - Loopback only. The server binds
127.0.0.1, not every interface. (SetHOST=0.0.0.0to opt back into LAN access.) - Origin-locked CORS. Only same-origin and localhost may call the local server, so a random website cannot.
The hosted demo (app.thoughtdag.workers.dev) was never affected — Cloudflare Workers can't spawn processes, so that code path doesn't exist there.
Which file do I download?
Already installed? None: the app updates itself (canvas menu → Check for updates). Fresh install, pick by system:
| Your system | File |
|---|---|
| macOS, Apple Silicon (M1 and later) | ThoughtDAG-0.3.14-arm64.dmg |
| macOS, Intel | ThoughtDAG-0.3.14.dmg |
| Windows | ThoughtDAG.Setup.0.3.14.exe |
| Linux | ThoughtDAG-0.3.14.AppImage |
Not sure which Mac: Apple menu → About This Mac. The .zip, .blockmap and .yml files serve the in-app updater; ignore them. Or skip the table: the download page detects your platform.