Skip to content

TencentCloudBase/CloudBase-AI-ToolKit

v2.21.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo MCP Developer Tools
โœ“ No known CVEs patched
Read the diff โ†’ Tool health โ†’ What is this tool? โ†’
This release patches 1 known CVE

Topics

ai aicoding cloudbase database mcp miniprogram
+5 more
postgresql supabase tencent vibe-coding web

Affected surfaces

rce_ssrf

ReleasePort's take

Moderate signal
editorial:auto 1mo

The release fixes a zip slip vulnerability in template extraction and introduces the TSRC security checklist.

Why it matters: Severityโ€ฏ90 zipโ€‘slip fix for template extraction requires immediate attention; adopt TSRC checklist to harden deployments.

Summary

AI summary

Updates ๐Ÿ› ้—ฎ้ข˜ไฟฎๅค, โšก ๅทฅ็จ‹ไผ˜ๅŒ–, and ๐Ÿ“š ๆ–‡ๆกฃๆ›ดๆ–ฐ across a mixed release.

Changes in this release

Security Critical

Fixes zip slip vulnerability in template extraction and adds TSRC security checklist

Fixes zip slip vulnerability in template extraction and adds TSRC security checklist

Source: llm_adapter@2026-06-04

Confidence: high

 โ€”
Feature Medium

Adds Codex plugin support for CloudBase Sites style site save and deploy

Adds Codex plugin support for CloudBase Sites style site save and deploy

Source: llm_adapter@2026-06-04

Confidence: high

 โ€”
Feature Medium

Adds cloudbase-vibe-coding core runtime (lib/bin/hooks)

Adds cloudbase-vibe-coding core runtime (lib/bin/hooks)

Source: llm_adapter@2026-06-04

Confidence: high

 โ€”
Feature Medium

Supports secure cloud-mode deployment via preโ€‘signed URLs (cloud-mode-safe deploy)

Supports secure cloud-mode deployment via preโ€‘signed URLs (cloud-mode-safe deploy)

Source: llm_adapter@2026-06-04

Confidence: high

 โ€”
Feature Medium

Optimizes manageApps to default framework=static and enable cloudโ€‘mode deployment

Optimizes manageApps to default framework=static and enable cloudโ€‘mode deployment

Source: llm_adapter@2026-06-04

Confidence: high

 โ€”
Feature Medium

Adds CloudBase WeChat integration Skill

Adds CloudBase WeChat integration Skill

Source: llm_adapter@2026-06-04

Confidence: high

 โ€”
Bugfix Medium

Fixes incorrect return value description for wx.cloud.callHTTPFunction

Fixes incorrect return value description for wx.cloud.callHTTPFunction

Source: llm_adapter@2026-06-04

Confidence: high

 โ€”
Bugfix Medium

Fixes static hosting upload readiness judgment issue

Fixes static hosting upload readiness judgment issue

Source: llm_adapter@2026-06-04

Confidence: high

 โ€”
Bugfix Medium

Fixes resource permission example error

Fixes resource permission example error

Source: llm_adapter@2026-06-04

Confidence: high

 โ€”
Bugfix Medium

Fixes cloudbase-sites deployment policy sync issue, aligning with latest rules and tool descriptions

Fixes cloudbase-sites deployment policy sync issue, aligning with latest rules and tool descriptions

Source: llm_adapter@2026-06-04

Confidence: high

 โ€”
Full changelog

CloudBase MCP v2.21.0

๐ŸŽ‰ ๆ–ฐๅŠŸ่ƒฝ

CloudBase Sites ๆ’ไปถ

  • ๆ–ฐๅขž Codex ๆ’ไปถๆ”ฏๆŒ๏ผŒๆ”ฏๆŒ Codex-Sites ้ฃŽๆ ผ็š„็ซ™็‚นไฟๅญ˜ไธŽ้ƒจ็ฝฒ
  • ๆ–ฐๅขž cloudbase-vibe-coding ๆ ธๅฟƒ่ฟ่กŒๆ—ถ๏ผˆlib/bin/hooks๏ผ‰

้ƒจ็ฝฒ่ƒฝๅŠ›ๅขžๅผบ

  • ๆ”ฏๆŒ้€š่ฟ‡้ข„็ญพๅ URL ่ฟ›่กŒไบ‘ๆจกๅผๅฎ‰ๅ…จ้ƒจ็ฝฒ๏ผˆcloud-mode-safe deploy๏ผ‰
  • ไผ˜ๅŒ– manageApps ้€ป่พ‘๏ผŒ้ป˜่ฎค้‡‡็”จ framework=static๏ผŒๅฏ็”จไบ‘ๆจกๅผ้ƒจ็ฝฒ

Skills ๆ‰ฉๅฑ•

  • ๆ–ฐๅขž CloudBase WeChat ้›†ๆˆ Skill

๐Ÿ› ้—ฎ้ข˜ไฟฎๅค

  • ไฟฎๅคๆจกๆฟ่งฃๅŽ‹ๆ—ถ็š„ zip slip ๅฎ‰ๅ…จๆผๆดž๏ผŒๆ–ฐๅขž TSRC ๅฎ‰ๅ…จๆฃ€ๆŸฅๆธ…ๅ•
  • ไฟฎๅค wx.cloud.callHTTPFunction ่ฟ”ๅ›žๅ€ผๆ่ฟฐ้”™่ฏฏ
  • ไฟฎๅค้™ๆ€ๆ‰˜็ฎกไธŠไผ ็Žฏๅขƒๅฐฑ็ปชๅˆคๆ–ญ้—ฎ้ข˜
  • ไฟฎๅค่ต„ๆบๆƒ้™็คบไพ‹้”™่ฏฏ
  • ไฟฎๅค cloudbase-sites ้ƒจ็ฝฒ็ญ–็•ฅๅŒๆญฅ้—ฎ้ข˜๏ผŒๅฏน้ฝๆœ€ๆ–ฐ rules ๅ’Œ tool ๆ่ฟฐ

๐Ÿ“š ๆ–‡ๆกฃๆ›ดๆ–ฐ

  • ๆ˜Ž็กฎ CloudBase ๅŸŸๅ Skills ็š„ MCP-fetch ไฝฟ็”จ่ง„่Œƒ
  • ๆ›ดๆ–ฐๅญ˜ๅ‚จๅทฅๅ…ทๆ–‡ๆกฃๅ’Œ schema ๅฎšไน‰๏ผŒๅผ•ๅฏผไฝฟ็”จ permissions ๅทฅๅ…ท็ฎก็† ACL
  • ไผ˜ๅŒ– queryPermissions ๆ่ฟฐ๏ผŒๆ˜Ž็กฎ storage ACL ๆŸฅ่ฏข็คบไพ‹

โšก ๅทฅ็จ‹ไผ˜ๅŒ–

  • ็ปŸไธ€ permissions ็›ธๅ…ณ tool ๆ่ฟฐ้ฃŽๆ ผ๏ผŒ็งป้™คใ€Œๆƒ้™ๅŸŸใ€ๆœฏ่ฏญ
  • ๆ–ฐๅขž .codebuddy/ ๅˆฐ .gitignore
  • ้€š่ฟ‡ pre-commit hook ่‡ชๅŠจๅŒๆญฅ mcp-tools.json ๅ’Œ tools.json
  • ๅŒๆญฅ Claude skills ๅ…ผๅฎน้•œๅƒ่‡ณๆœ€ๆ–ฐ็‰ˆๆœฌ

Security Fixes

  • Fix zip slip vulnerability in template extraction with added TSRC security checklist
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track TencentCloudBase/CloudBase-AI-ToolKit

Get notified when new releases ship.

Sign up free

About TencentCloudBase/CloudBase-AI-ToolKit

One-stop backend services for WeChat Mini-Programs and full-stack apps. Provides specialized MCP tools for serverless cloud functions, databases, and one-click deployment to production with China market access through WeChat ecosystem.

All releases โ†’

Related context

Earlier breaking changes

  • v2.20.0 Removes Tag parameter from deleteCollection, retaining only EnvId
  • v2.20.0 Blocks start_auth and logout operations when using API Key authentication mode

Beta — feedback welcome: [email protected]