v1.8.4

alibaba/MNNv1.8.4Apr 9, 2026by lfnovo

AI Summary

This release addresses critical security vulnerabilities reported by CERT-EU, including Remote Code Execution, Arbitrary File Write, and Arbitrary File Read.

Key Highlights

Fixed Remote Code Execution (CVSS 9.2) via unsandboxed Jinja2 environment.
Fixed Arbitrary File Write (CVSS 7.0) by sanitizing filenames and validating paths.
Fixed Arbitrary File Read (CVSS 8.2) by restricting file paths to the uploads directory.
Bumped ai-prompter to 0.4.0 to use SandboxedEnvironment.

Full Release Notes

## Security

Three vulnerabilities reported by CERT-EU Offensive Security Team via coordinated disclosure:

- **Remote Code Execution via Server-Side Template Injection** (CVSS 9.2 Critical)
  - User-created transformation prompts were rendered by an unsandboxed Jinja2 environment, allowing arbitrary Python code execution on the server. Bumped ai-prompter to 0.4.0 which uses `SandboxedEnvironment` for all template rendering.

- **Arbitrary file write via path traversal** (CVSS 7.0 High)
  - File upload did not sanitize filenames, allowing path traversal payloads (e.g., `../../../../tmp/test.txt`) to write files outside the upload directory. Filenames are now sanitized with `os.path.basename()` and resolved paths are validated.

- **Arbitrary file read via Local File Inclusion** (CVSS 8.2 High)
  - The source creation endpoint accepted arbitrary `file_path` values, allowing reading of any file on the container (e.g., `/etc/passwd`, `/proc/self/environ`). File paths are now validated to be within the uploads directory.

### Affected versions

All versions up to and including v1.8.3.

### Recommended action

Upgrade to v1.8.4 immediately.

### Credit

Reported by [CERT-EU](https://cert.europa.eu) Offensive Security Team via coordinated vulnerability disclosure.