ideon

v0.9.5 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 16d Productivity & Wikis

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

brainstorming collaboration idea-management knowledge-base mental-space pkm

+5 more

productivity project-management visual-thinking visual-workspace whiteboard

Affected surfaces

auth rce_ssrf

ReleasePort's take

Moderate signal

editorial:auto 11d

The v0.9.5 release now requires authentication for the /api/links/preview endpoint and blocks 0.0.0.0, ::, and ::0 to mitigate SSRF risks.

Why it matters: Addresses an unauthenticated SSRF relay by enforcing auth on /api/links/preview and blocking malicious address inputs; critical for securing API surface.

Summary

AI summary

Fixed an unauthenticated SSRF relay via /api/links/preview and added missing blocklist entries for 0.0.0.0, ::, and ::0.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Requires authentication for /api/links/preview endpoint; blocks 0.0.0.0 and :: addresses to prevent SSRF. Requires authentication for /api/links/preview endpoint; blocks 0.0.0.0 and :: addresses to prevent SSRF. Source: llm_adapter@2026-07-15 Confidence: high	—

Full changelog

Security

Fixed an unauthenticated SSRF relay (GHSA-vpc2-r395-534p) where the /api/links/preview endpoint accepted requests without a valid session, allowing anyone to use the server as an anonymous outbound HTTP relay. The endpoint now requires authentication. Additionally, closed a gap in the SSRF blocklist where 0.0.0.0 (and IPv6 :: / ::0) was not blocked — on Linux these addresses route to the loopback interface at the kernel level. Reported by @de3erve.

Security Fixes

GHSA-vpc2-r395-534p — Unauthenticated SSRF relay fixed; `/api/links/preview` now requires authentication and blocklist now includes `0.0.0.0`, `::`, `::0`.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track ideon

Get notified when new releases ship.

About ideon

Your project is scattered across too many tools. Map the chaos on an infinite canvas where notes, files, TO-DOs (and more!) finally live together.

All releases →