Ghostwriter v7.2.6

Summary

This is a small release to close issue #924. This will also trigger rebuilding new images to address an issue in the v7.2.5 images.

CHANGELOG

[7.2.6] - 10 August 2026

Fixed

• Fixed a report finding ordering feedback loop that could generate excessive Hasura events, database writes, and logs after bulk inserts (Closes #924)
  • Finding positions now converge deterministically under concurrent and out-of-order events without delaying collaborative updates
  • Long-running collaborative editors renew document-scoped JWTs through the authenticated Django session

Ghostwriter v7.2.5

Summary

This release is all about tightening security and fixing a few related bugs along the way. We've been doing a review of the codebase to tighten up controls and make some authorization models less ambiguous.

A couple of notable change here:

One is adjustment to template management authorization. We previously allowed anyone to adjust templates, but determined we wanted to limit the impact that any one user could have on reports globally. Now, users can only upload new templates when uploading it for a specific client to which they have access. They cannot edit global templates. They also cannot edit client templates if the protected boolean is set. Only managers can edit protected templates, create new global templates, or edit existing templates. Some teams may delegate this work to a technical writer and you may not want that person to have manager-role access. For those use cases, there is now a template management permission that admins can toggle on for an account with the user role.

The other big change is a scheduled task allowlist. Ghostwriter now uses a customized Django Q scheduler that checks any commands against the allowlist. This greatly simplifies configuration for Ghostwriter's available scheduled tasks while also preventing the execution of arbitrary tasks. The allowlist is configured in the .env file on disk and controls args, kwargs, and hooks. This separates access for an admin who only needs access to the admin panel and admins who also manage the server. This is intentional to prevent application admins from being able to run commands on the system via the scheduler. Teams can now make someone an admin in the application while also controlling which, if any, system tasks or commands they are allowed to execute.

CHANGELOG

[7.2.5] - 1 August 2026

Changed

• Improved logging for skipped signal imports and background task failures

Fixed

• Fixed block-level rich-text content rendering outside table cells in Word reports
  • Headings, blockquotes, code blocks, lists, page breaks, evidence, images, and captions now remain in their original cells
• Corrected the AJAX URL for deleting report observations
  • This fixed a typo in the path, but had no effect on functionality
• Fixed activity-log sanitization confirmation and scoped its CSRF header to its own request
• Fixed expired API and service token feedback so the appropriate token row and empty state are updated in the UI
• Fixed PowerPoint report generation when rich-text table cells contain block quotes or pre-formatted text

Security

• Restricted report finding reorder operations to findings attached to the authorized report
  • Reorder requests containing a finding from another report are rejected without modifying any findings
• Prevented report titles from being interpreted as HTML when activating a report
• Restricted GraphQL local finding-note updates and deletions to the note owner for non-privileged users
• Restricted global and protected report template management and template deletion across Django and Hasura
  • Managers, administrators, and users explicitly granted report template management permission may administer global templates
  • Report template management permission does not grant access to unrelated clients or projects; client-scoped templates retain their existing client access checks
  • Regular users may continue creating and editing unprotected templates for clients they can access
• Required bearer authentication and authenticated-principal authorization for Hasura tag actions
  • Direct public access to tag action handlers is blocked, and the shared action secret no longer has an insecure default
• Restricted report filename rendering to detached JSON primitives and applied matching validation to Django and Hasura template uploads
  • Report-controlled Jinja templates can no longer reach live serializers, querysets, models, or other application objects
• Hardened Jinja2 report rendering against sandbox escapes while preserving user-authored report templates and previews
  • Operation-log values are treated as literal report data, including values containing captured Jinja2 payloads
  • Lazy rich-text rendering now rejects templates that were not compiled by Ghostwriter's sandboxed environment
  • Report template objects, Python callables, and document-export objects no longer expose unsafe attributes or call paths to Jinja2
• Hardened user-controlled values rendered in JavaScript contexts to prevent stored cross-site scripting
  • Autocomplete data is now serialized as inert JSON instead of being interpolated into JavaScript source
  • Tag autocomplete suggestions are scoped to objects the current user can access
  • Additional inline JavaScript values and activity-log rich-text previews are escaped or sanitized for their output context
  • These changes are related to GHSA-5xvc-cm65-jw3p, but go beyond that to further harden sanitization (Thank you to @hippiiee for reporting the original issue!)
• Added matching Django and Hasura validation for domain and static server names while preserving user access to create and manage shared inventory
• Restricted Django Q scheduled tasks to a server-controlled allowlist (Closes #911)
  • The admin panel now exposes only approved functions, Slack notification hooks, and validated task arguments
  • Optional system commands must be configured as fixed argument vectors on the server and run without a shell
  • Schedule saves, queue submissions, result hooks, and worker execution enforce the policy independently
  • Added audit_django_q_policy to identify or pause existing schedules that do not satisfy the configured policy

Ghostwriter v7.2.4

Summary

This release adds some helpful tags to the editors. You can now easily insert the current date or time in UTC. This is helpful if you're taking note, writing your report as you are performing the actions, or updating your activity log.

CHANGELGO

[7.2.4] - 21 July 2026

Added

• Added shortcuts to the editors for easily inserting dates and times
  • @now / @time inserts HH:mm:ss UTC
  • @today / @date inserts the date using Django’s configured DATE_FORMAT
  • Spaces and unicode punctuation trigger the expansion
  • There are guards in place so code blocks and email-like strings do not trigger expansion
  • If an editor is left open over night, there is a trigger to refresh the date

Fixed

• Fixed an issue where a blank line would be included after lists in report output

Ghostwriter v7.2.3

Summary

This release includes some maintenance work and a few oplog changes to improve the user experience.

CHANGELOG

[7.2.3] - 18 July 2026

Added

• Added a Now button to the End Date field in the oplog entry form
  • This button sets the field to the current date and time
  • Useful for editing the end date of an action after a command finishes
• Added a Default Source field to logs
  • Whatever string you set here will be set as the source IP/hostname for any new log entries
  • Useful if you are manually logging multiple activities from the same system
  • This is an experiment; if it is useful, we will explore this for other fields

Changed

• The oplog entry edit form will now open automatically when you create a new entry
• Made oplog datetime values consistent with the server's timezone
  • Ghostwriter defaults to UTC for the server
  • New entries always started with the Start Date & Time set to "now" in UTC (regardless of the server timezone)
  • The datetime values are always stored in the database as UTC
  • Now, the oplog is aware of the server's timezone and will use it for datetime entry

Fixed

• Fixed loaddata trying to also load the demo BloodHound JSON during a build
  • This caused an error that could be confused as a build failure
  • loaddata now only loads initial.json

Security

• Updated the Hasura GraphQL container image to v2.45.6 to take advantage of bug and security fixes

Ghostwriter v7.2.2

Summary

This release squashes some issues and introduces activity log sanitization auditing. It is now simple to determine if your activity logs have been sanitized to adhere with your data retention policy, when, by who, and how.

There is also a semi-experimental management command to populate the database with demo data. Great for demos, experimentation, development, or trying out Ghostwriter as a new user.

CHANGELOG

[Unreleased]

Added

• Added a category_value filter to parse domain categories for presenting in the interface
  • The filter handles more than just the basic {"source": "category"} pairings from VirusTotal
  • Ensures the result is a string that can be safely passed through bleach
• Added a management command to populate a test database for test environments and demonstrations
  • This new command applies Ghostwriter's database fixtures and then populates a deterministic test database
  • The goal is to populate the database with data that looks real enough to immediately jump into a "live" environment
  • It also creates a custom field of each type on every model that supports custom fields
  • More information in the wiki
• Added sanitization auditing and status to activity logs
  • Each completed, on-demand sanitization records its time, requesting user, and selected fields
  • Log entries now track material updates, allowing Ghostwriter and GraphQL clients to identify logs changed since their most recent sanitization
  • The activity-log header displays sanitization status and details, including when it is no longer current

Fixed

• Fixed heading bookmarks not appearing in Word's bookmark list when using Insert > Bookmark (Fixes #707; Closes #792)
  • Ghostwriter now emits two bookmarks over each heading’s text, a visible name and a hidden _Refname alias
  • Captions keep only _Refname, and {{.ref}} keeps targeting _Refname
  • This preserves old templates while making only headings appear in Word’s normal bookmark list
• Fixed oplog edit modal scrolling to the bottom on open under certain conditions
• Fixed some collab editor styling and form handling
• Fixed multi-line table cells not rendering properly in reports

Ghostwriter v7.2.1

Summary

This release introduces several quality of life changes for admins and users alike and some bug fixes.

CHANGELOG

[7.2.1] - 9 July 2026

Added

• Added support for a new --required-only for loading seed data
  • Fixtures can now be flagged with "required": false
  • The loaddata command will not load fixtures marked as such when the flag is set
• Added option to scope a service token by client
  • This works similarly to All Accessible Projects but filters the access by one or more clients
  • The token will have access to all current and future user-accessible projects under the selected client(s)
• Added preview modals for findings and observations on reports
  • These now have Preview buttons in their dropdown menus
• Added jinja2 rendering to field preview modals for finding, observation, report, and project fields
  • Continuing preview enhancements from v7.2.0, previews now render Jinja2 templating using the report context
  • Clicking the Preview buttons will now trigger the modal and a Rendering rich text preview... loading message
  • It will take a moment to generate the context and render any Jinja2
  • If there are syntax errors, rendering will fail and there will be an error message
• Added configuration options to the General Settings to control maximum token lifetime and credential rotation
  • Maximum Token Lifetime in Days (default: 365) limits how far into the future a token expiry date may be set
  • Require Token Rotation to Extend Expiry (default: True) forces token rotation when extending expiry
• Added the option to regenerate API and service tokens to immediately roll the credential and receive a new token

Changed

• Updated Ghostwriter CLI Binaries: Updated the pre-built Ghostwriter CLI binaries to v1.0.1
• Marked the starter templates as non-required so they will not re-appear during updates and container builds if deleted
• Adjusted the Docker service configurations to cap log file size to 30MB (maximum of 3 files * 10MB each)
  • This caps the size of all logs to ~240MB
• Preview modals for rich-text fields now render references, captions, and client logo objects
  • References will be represented by your figure label and a placeholder—e.g., Figure #
  • Captions will also use the configured caption label and prefix and show the caption text–e.g., Figure # — Caption Contents
  • Client logo objects will insert the client logo when available
    • Logos are set to a static 6.5" width to align with Office's default width and keep very large or wide logos under control
• When editing an API token's expiration date, the form and back-end now enforce the Maximum Token Lifetime in Days setting
• The whoami query now works with service tokens
• Changed the Hasura GraphQL build to add a copy of BusyBox for health checks
  • The Hasura base image uses Ubuntu Jammy, and installing curl during emulated linux/arm64 builds can trigger libc-bin post-installation failures under QEMU
  • The Hasura image no longer runs apt-get just to provide a health check command
  • Hasura health checks now use the bundled BusyBox wget probe instead of curl

Fixed

• Removed tags from autocomplete suggestions in filters so they work as expected when selecting them (Fixes #927)

Security

• Adjusted WebSocket consumers to check object access to match access controls used elsewhere
  • Please see security advisory for details: GHSA-f6w3-9v9c-5364

Ghostwriter v7.2.0

Summary

This release brings a major change to evidence management: the full deprecation of finding-level evidence, as promised in v6.0.

When evidence management was first introduced in Ghostwriter, findings were the only supported evidence destination, so evidence was attached directly to individual findings. As Ghostwriter matured and gained new features, such as report sections and observations, users needed to reuse evidence in more places. To support that, we added the option to attach evidence either to a finding or to a report.

Over time, the community identified limitations with this model and asked we simplify it. That time has come, so please be aware of this and communicate the change to your users before upgrading.

The included migrations will convert any finding-level evidence to report evidence. If there happens to be a naming conflict, the migrations will handle that for you. They will also update references in the finding if the evidence's name changes. This should be a rare occurrence because the client enforced unique names across all evidence under a report, but the database technically allowed duplicate names as long as the name was unique for the finding or report.

CHANGELOG

[7.2.0] - 30 June 2026

Added

• Added Playwright as a local dev package for end-to-end testing
• Added evidence metadata parser coverage for collaborative editor evidence loading

Changed

• Breaking: All evidence now attaches to a report object and is available to all findings and other report fields
• XLSX report exports now populate the "Supporting Evidence" column from report evidence references used by each finding
  • This includes first-class evidence objects, legacy {{.Evidence Name}} tags, {{.ref Evidence Name}} references, and {{.caption Evidence Name}} captions
• Collaborative editor evidence loading now validates report metadata before querying evidence and keeps the evidence tool disabled only until report-scoped evidence context is ready
  • Users can still upload and insert report evidence from finding, observation, and report extra field editors
• Previews of extra fields now more closely match your report configuration
  • Image evidence will appear in accordance with your border, image width, and alignment configurations
  • Captions will appear above or below evidence based on the configured location
  • Text evidence now matches other code blocks as they typically do in the final reports
    • They no longer inherit a border based on the border configuration
    • They are now the full width of the content instead of bound to the evidence width intended for images
• The extra fields section of the report dashboard now presents fields as cards for easier review and access
• Loading of JSON extra fields is now "lazy" to defend page performance when these fields contain large JSON blobs
  • The JSON data is also removed after closing the preview to maintain page performance

Fixed

• Fixed severity colors appearing incorrect in xlsx reports

Removed

• Breaking: Removed finding-level evidence ownership
  • Existing finding-owned evidence migrates to the owning report
  • In case of friendly name collisions, the migration adjusts the friendly name as needed to preserve both evidence records
  • References to renamed migrated evidence update in the source finding's rich-text fields and extra fields
  • The evidence upload API and Hasura metadata no longer accept non-empty finding or findingId evidence associations

Ghostwriter v7.1.3

Summary

This release includes an optimization for service tokens that should significantly improve speed for large GraphQL queries that might otherwise timeout through the nginx proxy.

CHANGELOG

[7.1.3] - 26 June 2026

Changed

• Optimized service-token GraphQL user-resolution permissions for large project queries
  • Service-token access now resolves related project users through a database-backed access view instead of repeatedly expanding a large Hasura permission tree
  • Project and operation log service-token scopes remain unchanged

Fixed

• Fixed icons on filter fields not displaying properly

Ghostwriter 7.1.2

Summary

This release further locks down client-associated report templates based on user feedback. It also includes a small bug fix to improve compatibility with older browsers.

CHANGELOG

[7.1.2] - 24 June 2026

Fixed

• Fixed datetime-local rendering for white card and deconfliction edit forms so saved timestamps display reliably in older browsers (Closes #917)

Security

• Fixed additional client-scoped report template authorization bypasses in template swapping, report generation, archive generation, linting, and lint result endpoints
  • Report template selection now only accepts global templates or templates scoped to the report project's client
  • This fix includes two temporary breaking changes for the API while we work on a custom endpoint to handle this new business logic:
    • Breaking: The GraphQL API no longer allows user or manager roles to set report template ID columns directly when creating or updating reports
    • Breaking: The GraphQL API no longer allows user or manager roles to update a report's project ID column directly

Ghostwriter v7.1.1

Summary

This release addresses a pair of issues to make Ghostwriter better.

CHANGELOG

[7.1.1] - 18 June 2026

Fixed

• Fixed project collaborative notes failing to load for users with project access (Fixes #913)
  • The collaborative editor JWT is now scoped to the project so assigned users, project invitees, client invitees, managers, and admins can edit shared project notes

Security

• Fixed an authorization bypass that allowed authenticated users to download client-scoped report templates by direct URL
  • Template downloads now use the same client access check as the template detail page
  • Please see security advisory for details: GHSA-hx63-6fvp-4rpv