Banshee v0.3.1

Banshee v0.3.1

This alpha patch release fixes a JWT time-claim bypass and updates the library
behind jwt verify. There are no CLI, report or rule schema changes.

Highlights

• JWT exp/nbf bypass fixed (CVE-2026-25537). Before this release, a
  token whose exp or nbf claim had the wrong JSON type (for example the
  string "99999999999") skipped the time check, so jwt verify could report
  the token as time-validated. The jsonwebtoken library now rejects such
  tokens, and jwt verify additionally refuses any exp or nbf that is not
  a non-negative integer when time validation is on. Use --ignore-time to
  verify the signature of such tokens without relying on those claims.
• jsonwebtoken 10.3.0. Signature verification now goes through aws-lc-rs.
  A direct optional aws-lc-rs dependency enables prebuilt-nasm, so Windows
  x86_64 builds still need no NASM. The rsa crate (RUSTSEC-2023-0071, no
  upstream fix) is not part of the build, and cargo audit --deny warnings
  is clean for the main, fuzz and browser lockfiles.
• zip 9.0.3. The zip 6.x to 8.x releases, including the 7.2.0 used by
  0.3.0, were yanked from crates.io, which turned the dependency audit red.
  ZIP, JAR, APK and Office inspection now use 9.0.3. Entries whose names are
  not valid text are listed with a lossy name instead of failing the listing.
• Browser demo workflow. .github/workflows/pages.yml can publish the
  single-file browser build to GitHub Pages once Pages is enabled for the
  repository. It does not change the released packages.

See the changelog for the full list.

Compatibility

• jwt verify can now fail on tokens it previously reported as valid: those
  with a non-integer exp or nbf. That is the intended behavior.
• Native builds compile the aws-lc C library, which adds some build time and
  binary size compared with 0.3.0. The browser build is unaffected.

Downloads

Packages are built for Windows x86_64 (MSVC), Linux x86_64 and ARM64 (GNU) and
macOS Intel and Apple Silicon, each with a SHA-256 sidecar and verified build
and SBOM attestations. Verify the checksum before extracting. Linux packages
require a compatible glibc.

Limits

Banshee remains alpha software. Findings and secret detection are heuristic.
Authenticode, SPF/DKIM/DMARC and JAR/APK signing details are read, not
verified. Bytecode and DEX code are not decompiled. Evidence hashes check
consistency, not the identity of the evidence creator. JWT inspection is not
signature verification unless you run jwt verify; certificate checks are
offline and do not query revocation services. Review sensitive output before
sharing.