v1.4.431

danielmiessler/Fabricv1.4.431Mar 6, 2026by github-actions[bot]

AI Summary

Implemented critical security updates to prevent credential leakage and injection attacks in the application.

Key Highlights

Added `maskAPIKey` to redact sensitive credentials in config responses
Replaced shell commands with native file system APIs to eliminate shell injection vectors
Added path-confinement validation to block path traversal attacks

Full Release Notes

## Changes

### PR [#2049](https://github.com/danielmiessler/Fabric/pull/2049) by [ksylvan](https://github.com/ksylvan): Security Hardening: API Key Redaction, Path Traversal Prevention, and Shell Injection Elimination

- Fix: Redact API keys in config responses and eliminate shell injection surfaces.
- Added `maskAPIKey` to redact all but the last 4 characters of API keys, mitigating sensitive data exposure (CWE-200).
- Masked all provider API keys in the `GET /config` response payload to prevent accidental credential leakage.
- Replaced `exec`/shell commands in the Obsidian route with native `fs` APIs, fully eliminating shell injection vectors (CWE-78).
- Added path-confinement validation ensuring resolved file paths remain within their intended target directories, blocking path traversal attacks (CWE-22).