Skip to content

5dive

v0.13.27 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 3d AI Agents & Assistants
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

agent-runtime agentic-engineering agentic-loops agents ai-agents ai-assistant
+14 more
ai-coding-assistant ai-tools antigravity autonomous-agents claude claude-code codex codex-cli coding-agent loop-engineering multi-agent openclaw self-hosted zero-human-company

Affected surfaces

auth

Summary

AI summary

Fixed security vulnerability allowing non-root agents to forge SUDO_UID and bypass human-evidence gates.

Full changelog

Security: a non-root agent could forge SUDO_UID= to clear a human-evidence gate (approval/secret/manual) or spoof the withdraw actor as human. Both paths now trust SUDO_* only at EUID 0; off-root they judge by the unspoofable real uid. Legit human paths (dashboard/shelld exec run as claude; root secret-drop) still clear. Verified on-box in genuine uid/EUID contexts (8/8 forge-reject + legit-clear). DIVE-1831.

Security Fixes

  • CVE-2026-XXXXX — Non-root agents could forge SUDO_UID to bypass human-evidence gates; now only trusted at EUID 0.
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track 5dive

Get notified when new releases ship.

Sign up free

About 5dive

All releases →

Related context

Earlier breaking changes

  • v0.11.22 council amend now requires constitutional-class motion for constitution changes
  • v0.11.9 CLI now only OFFERS a veto to the genesis principal; EXERCISE requires authenticated tap.
  • v0.11.5 Raw bench add/rm of the primary council is refused.
  • v0.11.5 `council init` now requires sudo and seeds the primary council bench.
  • v0.10.7 Changes delegated-push grant to be BUILDER-SCOPED, limiting push permissions.

Beta — feedback welcome: [email protected]