This release includes 1 security fix for security teams reviewing exposed deployments.
Published 4mo
MCP Security & Auth
✓ No known CVEs patched
This release patches 1 known CVE
Topics
agent-security
ai-agent-security
ai-security
claude-code
codex
cursor
+14 more
hallucination-detection
llm-security
mcp
mcp-security
mcp-server
openclaw
owasp
package-hallucination
prompt-injection
static-analysis
security
supply-chain-security
vulnerability-scanning
windsurf
Affected surfaces
rce_ssrf
Summary
AI summaryUpdates Bug Fixes, Test Results, and New Features across a mixed release.
Full changelog
Security Fixes
- ReDoS vulnerability in prompt scanner — Added windowed regex matching (
safeMatch) that splits long inputs into overlapping 2KB chunks, capped base64 quantifiers, and added boundary anchors. 50KB input: 17s → 91ms (190x faster)
New Features
- Python taint fallback — stdlib
ast-based taint analyzer for regex mode (no tree-sitter required), with inter-procedural propagation and with-statement sink detection - Cross-file taint API — real import-graph + export-summary pipeline producing
cross-file-taintfindings with full taint paths
Bug Fixes
- Windows compatibility — NamedTemporaryFile handle closed before unlink, backslash normalization in history paths
- Fix templates — downgraded 7 broken auto-fix patterns to safe manual-fix responses
- Generic rules — technology-scoped rules gated by language relevance to eliminate false positives
- Semantic analysis — cross-platform Python resolution and real capability check (verifies tree-sitter import)
- scan-skill — pre-realpath path traversal check, DRY pattern normalization
- Flutter SDK packages — treated as legitimate dart dependencies
Test Results
- All 1325 tests pass
- Python interprocedural tests: 10/10
- Python AST engine tests: 5/5
- Prompt scanner + Garak validation: 36/36 (100% detection)
Install
npm install -g [email protected]
See CHANGES.md for full details.
Security Fixes
- ReDoS vulnerability in prompt scanner mitigated via windowed regex matching, capped base64 quantifiers, added boundary anchors (performance: 17s → 91ms for 50KB input)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Agent Security Scanner Mcp
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]