MulmoClaude

v0.5.2 Bugfix

This release fixes issues for SREs watching stability and regressions.

Published 1mo LLM Frameworks

✓ No known CVEs patched

✓ No known CVEs patched in this version

Affected surfaces

rce_ssrf

Summary

AI summary

Fixed image rendering in HTML/PDF by treating leading‑slash paths as workspace‑rooted while preserving boundary checks.

Full changelog

Fix image rendering in HTML / PDF — LLM-generated content emitting <img src="/artifacts/images/…"> (web-rooted convention) now renders correctly. The path-traversal hardening from #384 was correct but didn't recognise the leading-slash form, so:
- PDF generation logged image path escapes workspace and produced a broken <img>.
- presentHtml plugin's iframe srcdoc 404'd the image because /artifacts/ isn't served at the SPA origin.
Both paths now treat leading-slash as workspace-rooted while keeping the workspace boundary check intact (e.g. /etc/passwd is still rejected). (#961)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track MulmoClaude

Get notified when new releases ship.

About MulmoClaude

v0.6.4 `General` role split into lean `General` and new `Personal` role; Encore seed role pinned to Personal.