Skip to content

v2.26.8 — Security release (GHSA batch 3)

Choose a tag to compare

View all tags
@ChesterHsu ChesterHsu released this 11 Jul 03:51
Immutable release. Only release title and notes can be modified.
v2.26.8
bf748df

Security release fixing 5 advisories (all confined to v<=2.26.7):

  • GHSA-p34x-fmph-9fjx (Critical) — arbitrary file write via unguarded data.*/file.* modules (incomplete fix of GHSA-2956). All 8 file-writing modules now confine to FLYTO_SANDBOX_DIR.
  • GHSA-2mr3-rxrq-238c (High) — second-order SSRF in http.paginate via unvalidated Link: rel="next". Follow-up URLs are now SSRF-revalidated.
  • GHSA-pfg2-w999-497v (High) / GHSA-6pm8-6f34-9v3g (Medium) — DNS-rebinding SSRF (resolve-then-connect TOCTOU). Outbound modules now pin the validated IP via a guarded aiohttp resolver.
  • GHSA-mxcc-cr6x-2mvr (Medium) — path traversal in MCP run_recipe. load_recipe() confines to the bundled recipes dir.

See CHANGELOG.md for detail. pip install --upgrade flyto-core (2.26.8 on PyPI).

Assets 3
Loading