Skip to content

zn-gate 1.5.1

Marketplace
Marketplace

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Oct 15:19
· 122 commits to main since this release
v1.5.1
c00f7a7

Security release. On Windows, zn run in zn-gate 1.5.0 and earlier could pass secret values to a program chosen through the caller's environment when the approved command was a batch file. See GHSA-rf3f-ppm5-3xrx. Update with npm install -g zn-gate@1.5.1.

Security release, mainly for Windows. Update with npm install -g zn-gate@1.5.1. The Python package has no code changes in this release.

Security

  • Windows: zn run starts batch files through the system cmd.exe only. For a .cmd or .bat program (for example an npm-installed CLI), the program that received the secret values could be chosen through the caller's environment. zn run now starts the system's cmd.exe, found through the system itself rather than any environment variable (/d /v:off /s /c, arguments passed verbatim), refuses to run the batch file if it cannot find it, and refuses a program path containing %, ! or ", which cmd.exe would expand.
  • zn run removes interpreter start-up variables (NODE_OPTIONS, NODE_PATH, PYTHONPATH, PYTHONHOME, PERL5OPT, PERL5LIB, RUBYOPT, RUBYLIB, JAVA_TOOL_OPTIONS, _JAVA_OPTIONS, JDK_JAVA_OPTIONS, BASH_ENV, ENV and similar) from the environment of an approved program when it hands over secret values, as it already did for dynamic loader variables. On Windows it also sets NoDefaultCurrentDirectoryInExePath=1 for that program, so the programs it starts by name are not taken from the current directory.
  • Windows: the OpenCode plugin written by zn hooks install opencode --project starts zn with NoDefaultCurrentDirectoryInExePath=1, so cmd.exe does not run a zn.cmd planted in the project directory instead of the installed zn.
  • zn hooks install claude-code no longer runs a batch-file claude (an npm install on Windows) through cmd.exe to register the secrets MCP server; it prints the command to run instead (and claude mcp remove on uninstall).
  • An API key that cannot be a zn key (anything but 16 to 256 letters, digits, _, - and ., such as a blank value or a placeholder a launcher left unexpanded) now counts as unset, so ZN_CLOUD=1 with such a value keeps prompt analysis local.

Known limitations

  • Approving a batch file (.cmd, .bat) for a secret in zn run approves that file, not the programs it starts by name: an npm shim runs the node found on the caller's PATH. Prefer secrets_http_request for HTTP APIs, or approve the program itself.

How to verify these files: docs/verify-release.md

Assets 10
Loading