Skip to content

1.0.0-beta.23 (security)

Choose a tag to compare

View all tags
@jaylfc jaylfc released this 04 Jul 09:52
· 2581 commits to master since this release
v1.0.0-beta.23
ac15f39
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

  • Fixed a high-severity missing-authorization vulnerability (GHSA-h24f-gp4c-8qjm, CWE-862, CVSS 8.8). The skill-execution endpoint POST /api/skill-exec/{skill_id}/call ran built-in skills — including one that executes arbitrary Python on the host — with no authorization check, so an authenticated non-admin user could achieve remote code execution as the backend process user. Skill execution now requires an admin session or the host local token (the credential deployed agents authenticate with); a non-admin session is rejected with 403 before any skill code runs, with a defense-in-depth check at the code-execution sink. Reported by EQSTLab.

All users should update to 1.0.0-beta.23.

Assets 5
Loading