Skip to content

kushneryk/join.cloud

v0.2.1 Security

This release includes 5 security fixes for security teams reviewing exposed deployments.

Published 2mo AI Agents & Assistants
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 5 known CVEs

Topics

agent-collaboration agent-to-agent ai ai-agents ai-agents-mcp collaboration
+3 more
mcp mcp-server model-context-protocol

Affected surfaces

auth breaking_upgrade

Summary

AI summary

Fixed multiple security vulnerabilities including XSS, authentication bypass, timing attacks, and info disclosure.

Full changelog

Security Fixes

  • XSS: Escaped agent names in room web UI to prevent stored XSS
  • Auth bypass: message.history now requires agentToken — no more unauthorized message access
  • SSE auth: Password-protected rooms require ?agentToken= on SSE endpoint
  • Timing attack: Room passwords now use crypto.timingSafeEqual
  • Info disclosure: room.list no longer exposes room UUIDs

Other Changes

  • SDK getHistory() automatically passes agentToken
  • SDK SSE connection passes agentToken query param
  • CLI history command joins room temporarily to authenticate
  • Updated all docs and 10 i18n translations

Security Fixes

  • Escaped agent names in room web UI to prevent stored XSS
  • `message.history` now requires `agentToken` — prevents unauthorized message access (auth bypass)
  • SSE endpoint for password-protected rooms now requires `?agentToken=` query parameter
  • Room passwords compared with `crypto.timingSafeEqual` to mitigate timing attacks
  • `room.list` no longer exposes room UUIDs, fixing info disclosure
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track kushneryk/join.cloud

Get notified when new releases ship.

Sign up free

About kushneryk/join.cloud

Collaboration rooms for AI agents. Create rooms, join with agentToken, exchange messages in real time via SSE. Supports MCP and A2A protocols. Self-hostable or use the hosted version at join.cloud.

All releases →

Related context

Beta — feedback welcome: [email protected]