v1.4.511
danielmiessler/Fabricv1.4.511Oct 4, 2026by github-actions[bot]
Upgrading?
AI Summary
A critical security update fixes remote file write and shell injection vulnerabilities, while introducing a new Eisenhower Matrix prioritization pattern.
Key Highlights
- Fixed remote arbitrary file write vulnerability in API mode.
- Hardened path validation using `filepath.IsLocal` to reject absolute paths and traversal.
- Added new Eisenhower Matrix prioritization pattern for task triage.
New Features
- Security hardening for file operations
- Eisenhower Matrix pattern (eisenhower_matrix)
Full Release Notes
## Changes ### PR [#2107](https://github.com/danielmiessler/Fabric/pull/2107) by [johnpippett](https://github.com/johnpippett): Security: fix remote file write and shell injection in template extensions - Fixed a remote arbitrary file write vulnerability by disabling automatic application of file changes when running in API mode, preventing unsupervised writes triggered through the REST API's `PatternName` input. - Replaced the weak `strings.Contains(path, "..")` check in the file manager with proper path containment validation that rejects absolute paths and confirms resolved paths stay within the project root. - Hardened the path containment check in `ApplyFileChanges` by using `filepath.Rel`, correctly handling edge cases such as a project root of `/`. - Consolidated path validation in `ParseFileChanges` and `ApplyFileChanges` to a single `filepath.IsLocal` call, which rejects absolute paths, empty paths, directory traversal, and Windows reserved names. - Added a regression test that fails if the path containment guard is removed. ### PR [#2187](https://github.com/danielmiessler/Fabric/pull/2187) by [moritzschmitz-oviva](https://github.com/moritzschmitz-oviva): feat: add Eisenhower Matrix prioritization pattern - Added a new Eisenhower Matrix prioritization pattern for task triage and decision-making. - Renamed the pattern from `eisenhower` to `eisenhower_matrix` and removed the old pattern directory. - Relocated the Eisenhower Matrix pattern into `data/patterns`. - Registered the pattern's description and metadata with the BUSINESS, SELF, and STRATEGY tags. - Added task classification and a weekly planning extract to the pattern.
Related Repositories
ollama/ollama★ 184,207
Get up and running with Kimi, GLM, MiniMax, DeepSeek, gpt-oss, Qwen, Gemma and other models.
fatedier/frp★ 110,051
A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.
infiniflow/ragflow★ 92,612
RAGFlow is a leading open-source Retrieval-Augmented Generation (RAG) engine that fuses cutting-edge RAG with Agent capabilities to create a superior context layer for LLMs
gohugoio/hugo★ 90,198
The world’s fastest framework for building websites.
junegunn/fzf★ 83,716
:cherry_blossom: A command-line fuzzy finder