Skip to content

Claude-BugHunter

v2.1 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 1mo Offensive & Pentesting
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 3 known CVEs

Topics

ai-security anthropic application-security bug-bounty bugbounty bugcrowd
+10 more
claude claude-code claude-skills ethical-hacking hackerone offensive-security pentesting penetration-testing security-tools web-security

Affected surfaces

rce_ssrf breaking_upgrade

ReleasePort's take

Moderate signal
editorial:auto 1mo

The v2.1 release patches critical path‑traversal and shell‑injection flaws in CLI commands, `hunt.sh`, and related workflows while expanding the skill set with new hunting capabilities.

Why it matters: Fixes high‑severity vulnerabilities (severities 90 & 85) affecting file writes and command injection; all users of `cbh recon`, `cbh report --out`, and `hunt.sh` must upgrade immediately to prevent exploitation.

Summary

AI summary

Updates ✨ Added, 🔒 Fixed, and https://github.com/elementalsouls/Claude-BugHunter/blob/main/docs/skills.md across a mixed release.

Changes in this release

Security Critical

Fixes path traversal and arbitrary file write vulnerabilities in `cbh recon` and `cbh report --out`.

Fixes path traversal and arbitrary file write vulnerabilities in `cbh recon` and `cbh report --out`.

Source: llm_adapter@2026-06-05

Confidence: high

 —
Security High

Fixes shell injection vulnerability in `hunt.sh` engagement scaffold.

Fixes shell injection vulnerability in `hunt.sh` engagement scaffold.

Source: llm_adapter@2026-06-05

Confidence: high

 —
Feature Medium

Adds 20 new `hunt-*` skills (e.g., `hunt-lfi`, `hunt-nosqli`, …).

Adds 20 new `hunt-*` skills (e.g., `hunt-lfi`, `hunt-nosqli`, …).

Source: llm_adapter@2026-06-05

Confidence: high

 —
Feature Low

Adds CI skill‑linter that validates `SKILL.md` files and blocks leaked secrets.

Adds CI skill‑linter that validates `SKILL.md` files and blocks leaked secrets.

Source: llm_adapter@2026-06-05

Confidence: high

 —
Feature Low

Adds Docs site under `docs/` with searchable skill catalog.

Adds Docs site under `docs/` with searchable skill catalog.

Source: llm_adapter@2026-06-05

Confidence: high

 —
Feature Low

Adds community infrastructure: issue/PR templates, CODEOWNERS, CODE_OF_CONDUCT.md, CHANGELOG.md, FUNDING.yml.

Adds community infrastructure: issue/PR templates, CODEOWNERS, CODE_OF_CONDUCT.md, CHANGELOG.md, FUNDING.yml.

Source: llm_adapter@2026-06-05

Confidence: high

 —
Feature Low

Adds function‑level access control section and Azure App Service takeover fingerprint to `hunt-subdomain`.

Adds function‑level access control section and Azure App Service takeover fingerprint to `hunt-subdomain`.

Source: llm_adapter@2026-06-05

Confidence: high

 —
Bugfix Medium

Fixes Q5 validation‑gate logic to prevent duplicate entries from passing.

Fixes Q5 validation‑gate logic to prevent duplicate entries from passing.

Source: llm_adapter@2026-06-05

Confidence: high

 —
Bugfix Low

Adds loud warning when `--proxy` disables TLS verification.

Adds loud warning when `--proxy` disables TLS verification.

Source: llm_adapter@2026-06-05

Confidence: high

 —
Full changelog

Second major bundle release. 51 → 71 skills, a CI quality/safety gate, a docs site, and security fixes to the toolkit's own code.

✨ Added

  • 20 new hunt-* skills (community v3 expansion — thanks @muhsiindeniiz): hunt-lfi, hunt-nosqli, hunt-deserialization, hunt-cors, hunt-host-header, hunt-open-redirect, hunt-brute-force, hunt-session, hunt-ldap, hunt-nextjs, hunt-nodejs, hunt-dom, hunt-websocket, hunt-grpc, hunt-laravel, hunt-springboot, hunt-k8s, hunt-cicd, hunt-source-leak, hunt-tls-network. (28 → 48 hunt modules.)
  • CI skill-linter — validates every SKILL.md and blocks leaked secrets + client/engagement identifiers (SHA-256 denylist; plaintext names never enter the repo).
  • Docs site — GitHub Pages under docs/ with a searchable, auto-generated skill catalog.
  • Community infrastructure — issue/PR templates, CODEOWNERS, CODE_OF_CONDUCT.md, CHANGELOG.md, FUNDING.yml.
  • New hunt-auth-bypass function-level access control section; Azure App Service takeover fingerprint in hunt-subdomain.

🔒 Fixed (security — closes #13)

  • Path traversal (cbh recon) and arbitrary file write (cbh report --out) — real path containment.
  • Shell injection in the hunt.sh engagement scaffold — neutralized.
  • Q5 validation-gate logic (duplicates no longer pass).
  • Loud warning when --proxy disables TLS verification.

Credit: @sseshachala (report + fix), @muhsiindeniiz (skills), @xiaolai (earlier PRs).

💜 Sponsor

Atlas Cloud — full-modal AI inference, one API for video/image/LLM.

Full changelog: https://github.com/elementalsouls/Claude-BugHunter/blob/main/CHANGELOG.md

Security Fixes

  • Fixed path traversal in `cbh recon` and arbitrary file write in `cbh report --out`
  • Neutralized shell injection vulnerability in `hunt.sh` engagement scaffold
  • Added loud warning when `--proxy` disables TLS verification
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Claude-BugHunter

Get notified when new releases ship.

Sign up free

About Claude-BugHunter

All releases →

Related context

Beta — feedback welcome: [email protected]