1.0.8.6

blakeblackshear/frigate1.0.8.6Jun 11, 2026by givanz

AI Summary

This patch release focuses on critical security fixes addressing vulnerabilities related to private IP redirects, sanitization of HTML attributes, and file name filtering. It also includes updates to the admin template, page builder UI, and general plugin improvements.

Key Highlights

Fixed curl resolve to avoid private IP redirect and IPv6 bypass
Fixed sanitizeHTML for 'on' attributes when they contain '>'
Added recursive filtering for sanitizeFileName
Admin template and page builder UI updates
Fixed tree list expand arrow button click

New Features

Admin template update
Plugins update
Translations error handling improvements

Full Release Notes

* Use curl resolve to avoid private ip redirect and IPv6 bypass, vulnerability reported by @EvidentObscurity https://github.com/givanz/Vvveb/commit/e27d1ef097a8502c33f8cc94271c948407c5dce3
* Admin template update, page builder UI changes https://github.com/givanz/Vvveb/commit/a4882d42411466ea90b6612933b5d1f70fa7cc83
* Plugins update https://github.com/givanz/Vvveb/commit/513db6d716410d75bed99436bf5ed10384cca100
* Translations edit show server message on error, fixed tree list expand arrow button click https://github.com/givanz/Vvveb/commit/6bc8390957256dd831691f352e8c472fb3c91374
* Fixed sanitizeHTML( 'on' attributes sanitization when attribute has '>', vulnerability reported by @EvidentObscurity https://github.com/givanz/Vvveb/commit/c466e618ad1b94916f56062b7732edb5a336f57d
* Added recursive filtering sanitizeFileName(, vulnerability reported by @EvidentObscurity https://github.com/givanz/Vvveb/commit/8c062a047a66d6f04307f8d0e37c34f709a201a9