Skip to content

v2.0.1 - Security release

Choose a tag to compare

View all tags
@strnad strnad released this 24 Jul 19:14
· 2 commits to main since this release
v2.0.1
9578b3e
This commit was created on GitHub.com and signed with GitHub鈥檚 verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security release

This release fixes a critical security vulnerability and clears the outstanding dependency CVEs. All users should upgrade to v2.0.1 immediately.

馃敀 Fixed

  • Critical: Remote Code Execution in the Custom API Tool (GHSA-hm5m-fhf2-vrpq, CVSS 9.8). Full details are published in the security advisory. (#120)

猬嗭笍 Dependency security bumps (#121)

Bumped to patched versions, clearing ~26 Dependabot alerts: GitPython 3.1.52, pillow 12.3.0, mcp 1.28.1, soupsieve 2.8.4, pyasn1 0.6.4, json_repair 0.60.1, pypdf 6.13.1, setuptools 83.0.0.

鈿狅笍 Hardening reminder

The Streamlit UI ships with no authentication. If you expose CrewAI-Studio beyond localhost, put an authenticating reverse proxy (basic auth / OAuth) in front of it.

Assets 2
Loading