Skip to content

v1.7.4 — Security Hardening

Choose a tag to compare

View all tags
@nedcodes-ok nedcodes-ok released this 28 Feb 19:15
· 128 commits to main since this release
v1.7.4
671c337

Security release — 7 vulnerabilities fixed

Critical:

  • Sanitize numeric CLI parameters to prevent command injection via shell interpolation
  • Block SSRF: validate URLs and reject private IPs/localhost in team baseline fetches

High:

  • Path traversal protection on all rule file write operations (generate + team import)
  • ReDoS mitigation: skip oversized lines in conflict directive extraction

Medium:

  • Skip symlinks during file traversal to prevent arbitrary file reads
  • Detect dangerous command patterns in MCP server configurations
Assets 2
Loading