Skip to content

Loki Mode

v7.60.0 Security

This release includes 5 security fixes for security teams reviewing exposed deployments.

Published 1mo AI Agents & Assistants
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 5 known CVEs

Topics

ai-agents aider anthropic autonomous ci-cd claude
+13 more
cline code-review devops gemini github-action github-issues loki-mode multi-agent openai-codex openapi pull-request-review sdlc spec-driven-development

Affected surfaces

auth rbac rce_ssrf

Summary

AI summary

Updates dashboard/api_v2.py, non-admin, and autonomy/lib/proof_redact.py across a mixed release.

Full changelog

Security hardening: 5 HIGH findings from the adversarial sweep

  • Policy enforcement now fails CLOSED on a malformed policy file
    (src/policies/check.js, engine.js): a corrupt .loki/policies.json previously
    caused check.js to return ALLOW with a misleading "No policies configured"
    reason, silently disabling all policy enforcement. A present-but-unparseable
    policy file now denies (exit 1). A genuinely absent policy file still allows.
  • Tenant lifecycle ops are global-admin-only (dashboard/api_v2.py):
    create_tenant required only the control scope and skipped tenant enforcement,
    so a tenant-scoped (non-admin) token could create arbitrary tenants outside
    any isolation boundary. create/update/delete tenant now require global admin.
  • Authorization/Cookie headers are now redacted (autonomy/lib/proof_redact.py):
    a negative lookahead + Bearer-only rule meant Authorization: Basic ...,
    lowercase auth headers, and Cookie:/Set-Cookie: leaked their credentials
    in proofs and crash reports. A header-line rule now redacts the value (scheme
    word preserved) without over-redacting normal lines.
  • Dockerfile.sandbox dead-image fixed (Dockerfile.sandbox): the runtime
    stage never put the claude binary on PATH (loki start died "No AI provider CLI
    found"), the claude install was unvalidated, and loki-ts/data/ was missing
    (stale fallback pricing). All three fixed and verified with a real build +
    claude --version in-container.
  • cmd_magic python-literal injection closed (autonomy/loki): magic
    generate/update interpolated raw --description/--tags/--name into a python -c
    body; now passed via environment variables (the established LOKI_MEM_QUERY
    pattern) plus --name validation. cmd_memory export filename hardened too.

Each fix ships with a non-vacuous regression test. Full pytest gate: 1172 passed.

Breaking Changes

  • create_tenant, update_tenant, delete_tenant now require global admin scope (previously allowed control‑scope non‑admin tokens)
  • Malformed .loki/policies.json now causes policy enforcement to fail closed (exit 1) instead of silently allowing all access

Security Fixes

  • Policy file parsing now fails CLOSED on malformed files (CVE not listed, but closes a high‑severity bypass)
  • Tenant lifecycle operations restricted to global‑admin only (previously exploitable by non‑admin tokens)
  • Authorization and Cookie headers redacted in proofs and crash reports
  • Docker sandbox image fixed: claude binary added to PATH, install validated, missing data directory restored
  • cmd_magic python‑literal injection closed; descriptions/tags/names now passed via environment variables with validation
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Loki Mode

Get notified when new releases ship.

Sign up free

About Loki Mode

Multi-agent autonomous SDLC framework. Spec to deployed app. PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief. 5 AI providers, 11 quality gates.

All releases →

Related context

Beta — feedback welcome: [email protected]