v2026.08.27
OpenMOSS/MOSS-TTS-Nanov2026.08.27Aug 27, 2026by knu
Upgrading?
AI Summary
This security release addresses four critical vulnerabilities, including command injection in event URLs, unauthorized OAuth credential binding, and duplicate event delivery. It also includes a migration to disconnect unauthorized private bindings.
Key Highlights
- Fixes command injection vulnerability in PdfInfoAgent event URL
- Fixes unauthorized OAuth Service binding to other users' Agents
- Fixes manual event propagation across users' Agents
- Fixes duplicate event delivery in concurrent propagation scans
- Service-binding migration disconnects unauthorized private bindings
New Features
- Security patch for shell command execution
- OAuth credential isolation mechanism
- Event propagation authorization controls
- Service-binding migration tool
Full Release Notes
This security release fixes four issues: - A crafted PdfInfoAgent event URL could execute arbitrary shell commands even when insecure Agents were disabled. - An authenticated user could bind another user's private OAuth Service to an Agent, allowing the Agent to use the other user's stored OAuth credential. - An authenticated user could manually trigger event propagation across other users' Agents. - Concurrent propagation scans could deliver the same event more than once. The command-injection issue affects installations where untrusted users can create and connect Agents. The two authorization issues affect multi-user installations. The duplicate-delivery issue can affect any installation when propagation scans overlap and receivers perform non-idempotent work. Operators should upgrade promptly. The Service-binding migration disconnects unauthorized private bindings and disables affected Agents for administrator review. Full details: - https://github.com/huginn/huginn/security/advisories/GHSA-fc8p-86r3-g842 - https://github.com/huginn/huginn/security/advisories/GHSA-73v6-mq4f-33gw - https://github.com/huginn/huginn/security/advisories/GHSA-7824-m5cr-8pgj - https://github.com/huginn/huginn/security/advisories/GHSA-x7pc-rrfc-4chw **Full Changelog**: https://github.com/huginn/huginn/compare/v2022.08.18...v2026.08.27
Related Repositories
public-apis/public-apis★ 491,126
A collective list of free APIs
NousResearch/hermes-agent★ 255,898
The agent that grows with you
yt-dlp/yt-dlp★ 199,993
A feature-rich command-line audio/video downloader
microsoft/markitdown★ 191,478
Python tool for converting files and office documents to Markdown.
Significant-Gravitas/AutoGPT★ 187,699
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.