Skip to content

SAM v3.2.4 — Zero Known

Choose a tag to compare

View all tags
@richhabits richhabits released this 07 Aug 00:29
· 469 commits to main since this release
v3.2.4
eb1bfd6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Nothing changes in the app. This is 3.2.3 with four dependency advisories patched — plus an honest correction to which Node versions SAM actually runs on.

Security

Four advisories were published after 3.2.3 shipped, three of them in the production tree. Nothing in this repo changed to cause them; the advisories are new.

package what
high ip-address leading-zero octets decoded as decimal where resolvers read octal — an SSRF and trust-boundary bypass
high fast-uri host confusion via a backslash authority introducer
moderate hono ReDoS in the CORS middleware
moderate undici response desynchronisation via the retry interceptor

Lockfile only — no dependency was added, removed, or changed.

The ip-address advisory names the exact class of attack SAM’s own SSRF guard exists to stop, so to be clear: it is not in that path. It arrives via @modelcontextprotocol/sdk → express-rate-limit, and SAM only ever constructs an MCP client over StdioClientTransport — it never runs an MCP server, so that middleware never executes. server/url-guard.ts does its own resolution and never references the package.

Changed — running from source now requires Node 22.19+

This is not a new restriction. It has been true since undici went to 8.x, which refuses to load below 22.19. What was wrong was everything that described it: engines advertised ^20.19.0 || >=22.12.0, .nvmrc and .node-version pinned 20, the README asked for "20.19+ or 22.12+", and setup.sh waved through anything >= 20.

So someone following our own instructions exactly got a working install and a broken app — the URL guard and all four web-intel modules fail to import on Node 20. All five now state 22.19, and setup.sh checks the minor version, because 22.12 was permitted by the old text and is not good enough.

If you use the packaged app this changes nothing for you — it bundles its own Node 22. This affects running from source only.

Verified on Node 22: typecheck clean, 1522 passed / 2 skipped across 127 files, build clean, lint clean, no stats drift.

🔒 Verify your download (SHA-256)

The one-paste installers verify this automatically. To check by hand, compute the hash and match:

  • macOS/Linux: shasum -a 256 <file>
  • Windows (PowerShell): Get-FileHash <file> -Algorithm SHA256
cea1b90a57ca26cbb0fe7552263bade8ac9ff52fd8d58f0ba3445fc0546bb7a0  SAM-3.2.4-arm64.dmg
df41192afb25c1adc22452b98b200c32250bf0817bf6586d492629a9fd106c96  SAM-3.2.4.AppImage
22e460781501c25dfa74620e1c525ea088f4d4704b87debeedd9a32b7fe90a36  SAM-3.2.4.dmg
cdf0745f16c367f59f052eaff3f0f9d12d69eaf9f0c68c9a5a36cf80f28ba90b  SAM-Setup-3.2.4.exe
8070d6895c1cc1a79005bb2b6f2f12485d5c2c4065376021d3881ff64539a27c  sam_3.2.4_amd64.deb
Assets 18
Loading