Skip to content

degoog

v0.10.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 4mo Privacy & Ad-blocking
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

aggregator degoogle degoogle-your-life degoogling search-engine self-hosted

Affected surfaces

auth rce_ssrf breaking_upgrade

Summary

AI summary

Credential exfiltration vulnerability fixed by restricting API key forwarding to matching hostnames.

Full changelog


Join our discord community


Little dev note

Small update on my kid's situation - transplant went well and he's recovering beautifully.
We are still in intensive care but should move to the ward soon enough. Unless something terrible happens the worst part is almost over ❤️

Changelogs

bugfixes

  • Created entrypoint.sh, application starts as root and chowns /app/data to a defined or default PUID and PGID, this should make it easier to run the app rootless.
  • Credential exfiltration in /api/proxy/image, API key is now only forwarded if the destination hostname matches the plugin's stored url.
  • Fixed potential extension store path traversal
  • Fixed potential X-Forwarded-For IP spoofing, added a DEGOOG_DISTRUST_PROXY env var. Default behavior is unchanged. Set it to stop trusting the header when running without a reverse proxy.
  • extension settings modal now correctly sends x-settings-token on save. Previously all saves returned 401 silently when settings auth was configured.
  • Fix issue with store not working when installing degoog via proxmox VE #33 #12
  • Fix settings back button to go back to previous screen ONLY if the previous screen was degoog, otherwise default to homepage
  • Fix images resolution due to proxy mistake #39
  • Fix various styling inconsistencies
  • Fix PWA icon and sort out cors issues around webmanifest to make the install button consistent across majority of homemade reverse proxies.

features

  • Add language dropdown to search results (fully customisable from settings) #19
    • If you are developing/have developed custom engines make sure to add the new lang context (check the official store ones for my implementations), it's not mandatory but it'll be nice for users to get custom languages for custom engines too, so I made it scalable.
  • Add a DEGOOG_DEFAULT_SEARCH_LANGUAGE env variable for default search language
  • Add custom daterange option (doesn't work all the times, it really depends on the engines, but it DOES help filter out some results, we can keep working on it)
  • Add ability to open search results in a new tab (thank you @tacheraSasi - #31)
  • Change docker image to use alpine version (thank you @otomaid - #32)
  • Add lightbox zoom to image search results #34
  • Add engines breakdown to image/video results with retry button
  • Removed safe mode on engines for all the gooners in the chat and added a configurable option per engine to re-enable it. Custom engines will now support that too

official store updates

  • Most engines will require an update after this release, so all new features will work (it's minor stuff)
  • Added the ddg image engine which adds a ton of new images to image search
  • Added the brave search via api - I kinda worked blind on this one as I don't have an api key (requested, still awaiting for it), their documentation is very clear and I fed the output to a few llms telling them to fight each other for my soul and tell me if it works and they all said it should be working and only suggested changes that frankly added a ton of unnecessary bloat, so we should be good. If you have an api key for brave can you test and report in the issues tab if you find any problem?

Security Fixes

  • Credential exfiltration fixed: API key now forwarded only if destination hostname matches plugin's stored URL (CVE‑2025‑XXXXX not provided)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track degoog

Get notified when new releases ship.

Sign up free

About degoog

Search engine aggregator with plugins

All releases →

Related context

Beta — feedback welcome: [email protected]