Repository navigation
fix(security): close the open security advisories for v3.8.50 - #11028
Merged
Merged
Conversation
…ents POST /api/acp/agents lets a client register a custom agent controlling both `binary` and `versionCommand`. The version probe runs execFileSync(binary, args); the binary-match check alone still admits an eval argument on a matching interpreter (`node -e …`, `python -c …`, `ruby -e …`), which is arbitrary code execution with no shell metacharacter. `/api/acp/agents` is already LOCAL_ONLY (#7948) so the remote/anonymous vector is closed, but a loopback/LAN caller with requireLogin=false — or any authenticated caller — could still reach the sink. resolveVersionProbe() now restricts untrusted (requireBinaryMatch) probes to a bare binary or a single recognized version flag, so no code-running argument can pass. Built-in agents (requireBinaryMatch=false) are unaffected. Reported by @c111mb3r via GHSA-jphr-2gw7-xrwp and GHSA-hf57-cqmx-p4gr.
…eLogin=false /api/db-backups/export and /import sat outside ALWAYS_PROTECTED_API_PATHS, so with requireLogin=false an anonymous caller could stream the full SQLite database (api_keys, provider credentials, OAuth tokens) or replace it wholesale. Adding /api/db-backups to the Tier-2 allowlist requires a credential for all three sibling routes, matching the trade-off /api/settings/database already makes. Reported by @ntdat812 via GHSA-mghq-58h3-qcqj.
…hz matcher Next compiles the proxy matcher from `regexp.source` only, dropping path-to-regexp's case-insensitive flag, so `/v1/:path*` never matched `/V1/...` while the rewrite layer (flag kept) still routed it to the handler — an unauthenticated inference bypass via uppercase / mixed-case paths (/V1, /V1BETA, /CHAT, /RESPONSES, /CODEX, /MODELS). Expressing the casing inside a path-to-regexp custom group (`([vV]1)`) survives the flag-drop. classify.ts normalizes the control segment case so uppercase aliases resolve to CLIENT_API (honoring REQUIRE_API_KEY) instead of the management fallback. Reported by @Evgeny-SPB via GHSA-jvqc-mp9f-q936.
The manage-scope bypass veto's precise early-deny keys on
SPAWN_CAPABLE_PATTERNS, but /api/providers/{id}/chatgpt-web-codex-doctor — a
LOCAL_ONLY route that spawns a subprocess via getTunnelRuntimeStatus() — was in
LOCAL_ONLY_API_PATTERNS without a matching spawn-capable pattern, so the two
layers had drifted. Add the pattern plus a regression test asserting every
regex-tier LOCAL_ONLY spawn route is covered, so the veto's exact early-deny
stays in sync with the tier.
Reported by @Zandereins via GHSA-9q3h-mjm5-f4gj (finding 1).
Keeps the new security regression tests within the tests/ no-explicit-any budget and removes an unused eslint-disable directive flagged by the linter.
diegosouzapw
changed the title
Sa3id23
pushed a commit
to Sa3id23/OmniRoute
that referenced
this pull request
Aug 21, 2026
…g, db-backups tier, uppercase authz bypass, spawn-veto drift) (cheaper-inference#11028) ⭐5 — 4 achados STILL-REAL de advisories de segurança, cada um com TDD (RED→GREEN) e crédito ao reporter original: ACP RCE hardening (resolveVersionProbe), db-backups Tier-2 allowlist, uppercase authz bypass (matcher case-insensitive), spawn-veto drift (chatgpt-web-codex-doctor). typecheck/lint limpos, suíte authz/acp/cors verde. UNSTABLE é o base-red inherited cheaper-inference#9985, já documentado no corpo da PR.
muhamadgalihsaputra
pushed a commit
to niyatna/NiyatnaRoute
that referenced
this pull request
Sep 27, 2026
…g, db-backups tier, uppercase authz bypass, spawn-veto drift) (cheaper-inference#11028) ⭐5 — 4 achados STILL-REAL de advisories de segurança, cada um com TDD (RED→GREEN) e crédito ao reporter original: ACP RCE hardening (resolveVersionProbe), db-backups Tier-2 allowlist, uppercase authz bypass (matcher case-insensitive), spawn-veto drift (chatgpt-web-codex-doctor). typecheck/lint limpos, suíte authz/acp/cors verde. UNSTABLE é o base-red inherited cheaper-inference#9985, já documentado no corpo da PR.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Full triage + fix pass over the open GitHub Security Advisories against
release/v3.8.50. Every STILL-REAL / PARTIAL finding is fixed here (TDD:failing test → fix → green); the already-fixed, false-positive and
junk advisories were closed separately. Full triage:
_tasks/research/2026-08-21-security-advisories-triage.md.Each fix credits its reporter in the commit body.
⚠️ base-red inherited: #9985.RCE / auth-bypass / SSRF
node -esink)/V1/…no longer skips it)/api/db-backupsin ALWAYS_PROTECTED (no anonymous DB dump/replace)fetch()(base/glm/nlpcloud)regionvalidated on the device-code route before any outbound fetch/a2ahonors REQUIRE_API_KEYx-api-keychatgpt-web-codex-doctoradded to the spawn-vetoCredential / info exposure & hardening (operator chose "harden without breaking")
false(local-first) per operator choiceValidation
npm run typecheck:coreclean · ESLint clean on all changed files (only pre-existing suppressedno-restricted-importsremain, untouched)Notes / deferred (documented in the triage doc)
c7cg's flagship "shipped shared secrets" claim is a false positive (.envnever in the tarball; per-installrandomBytesgeneration; fail-closed login). TheINITIAL_PASSWORD=CHANGEMEwarning and0.0.0.0bind are documented local-first posture.9q3hF2 (strict-loopback vs loopback-OR-LAN doc divergence) + F3 (a tier→veto CI gate) are defense-in-depth follow-ups; F1 is fixed here.wg9psecond half) is a follow-up.