Skip to content

v0.0.53

Choose a tag to compare

@ckakgun ckakgun released this 26 Jun 10:56
· 331 commits to main since this release

What's Changed

Security Fixes : Security: fixed an authenticated sandbox escape in the workflow condition evaluator that allowed arbitrary Python and OS command execution on the backend host (GHSA-pm6h-x3h5-j38h). Condition expressions now run through a hardened, AST-based evaluator that blocks attribute traversal, and Slack/Telegram webhook verification now fails closed. Reported by @okcomputerfan (also known as pixileaf). Thank you.

Full Changelog: v0.0.52...v0.0.53