Kodiqa Agent

v3.5.0 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo AI Agents & Assistants

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 2 known CVEs

Topics

ai-coding-agent claude cli coding-assistant developer-tools ollama

+2 more

openai python

Affected surfaces

auth rce_ssrf

ReleasePort's take

Light signal

editorial:auto 1mo

Release v3.5.0 patches a workspace boundary bypass flaw that permitted unauthorized writes outside the designated workspace.

Why it matters: The fix blocks out‑of‑bounds write/delete attacks; all deployments using parallel tool path execution should upgrade immediately.

Summary

AI summary

Fixed workspace boundary bypass that allowed unauthorized write/delete outside the workspace.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Fixes workspace boundary bypass allowing writes outside workspace Fixes workspace boundary bypass allowing writes outside workspace Source: llm_adapter@2026-06-07 Confidence: high	—
Security	High	Fixes SSRF vulnerability in web_fetch by validating URLs and redirects Fixes SSRF vulnerability in web_fetch by validating URLs and redirects Source: llm_adapter@2026-06-07 Confidence: high	—
Bugfix
Bugfix	Medium	Fixes cost/budget reporting showing $0 for current models Fixes cost/budget reporting showing $0 for current models Source: llm_adapter@2026-06-07 Confidence: high	—
Bugfix	Medium	Fixes session restoration losing assistant messages and orphaned tool calls Fixes session restoration losing assistant messages and orphaned tool calls Source: llm_adapter@2026-06-07 Confidence: high	—
Bugfix	Medium	Fixes MCP stdio deadlock by draining stderr and adding timeout Fixes MCP stdio deadlock by draining stderr and adding timeout Source: llm_adapter@2026-06-07 Confidence: high	—
Bugfix	Low	Fixes batch-edit queue clobbering same‑file edits by composing them Fixes batch-edit queue clobbering same‑file edits by composing them Source: llm_adapter@2026-06-07 Confidence: high	—

Full changelog

High-severity fixes from the 2026-06-06 audit (security + data-loss).

Fixed

Workspace boundary bypass on multi-tool turns — the parallel tool path skipped the boundary check, letting a model write/delete outside the workspace unprompted. Now checked on every tool, with realpath so symlinks can't escape.
Cost/budget reported $0 for current models — COST_TABLE lacked the current alias targets (claude-sonnet-4-6, claude-opus-4-6, …). Added; budget tracks real spend.
Sessions lost assistant messages — _save_session kept only string content, dropping Claude content-block turns and orphaning OpenAI tool messages (400 on restore). Now saves full history, trimming only a trailing unresolved tool call.
SSRF in web_fetch — validates URLs (http/https only), rejects internal/loopback/link-local/cloud-metadata hosts, and re-checks every redirect hop.
MCP stdio deadlock — server stderr → DEVNULL (undrained pipe deadlocked at ~64KB), 30s read timeout so a hung server can't block, killed servers reaped.
Batch-edit queue clobbered same-file edits — two queued edits to one file now compose instead of only the last surviving.

Tests

Regression tests for SSRF, batch-edit clobber, and the cost table (295 total).

Security Fixes

Workspace boundary bypass on multi-tool turns — added realpath check to prevent model writes/deletes outside the workspace (CVE‑2026‑XXXXX)
SSRF vulnerability in `web_fetch` fixed by URL validation and redirect checks (CVE‑2026‑YYYYY)

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Kodiqa Agent

Get notified when new releases ship.

About Kodiqa Agent

All releases →