v1.4.511

danielmiessler/Fabricv1.4.511Oct 4, 2026by github-actions[bot]

Upgrading?

AI Summary

A critical security update fixes remote file write and shell injection vulnerabilities, while introducing a new Eisenhower Matrix prioritization pattern.

Key Highlights

  • Fixed remote arbitrary file write vulnerability in API mode.
  • Hardened path validation using `filepath.IsLocal` to reject absolute paths and traversal.
  • Added new Eisenhower Matrix prioritization pattern for task triage.

New Features

  • Security hardening for file operations
  • Eisenhower Matrix pattern (eisenhower_matrix)

Full Release Notes

## Changes

### PR [#2107](https://github.com/danielmiessler/Fabric/pull/2107) by [johnpippett](https://github.com/johnpippett): Security: fix remote file write and shell injection in template extensions

- Fixed a remote arbitrary file write vulnerability by disabling automatic application of file changes when running in API mode, preventing unsupervised writes triggered through the REST API's `PatternName` input.
- Replaced the weak `strings.Contains(path, "..")` check in the file manager with proper path containment validation that rejects absolute paths and confirms resolved paths stay within the project root.
- Hardened the path containment check in `ApplyFileChanges` by using `filepath.Rel`, correctly handling edge cases such as a project root of `/`.
- Consolidated path validation in `ParseFileChanges` and `ApplyFileChanges` to a single `filepath.IsLocal` call, which rejects absolute paths, empty paths, directory traversal, and Windows reserved names.
- Added a regression test that fails if the path containment guard is removed.

### PR [#2187](https://github.com/danielmiessler/Fabric/pull/2187) by [moritzschmitz-oviva](https://github.com/moritzschmitz-oviva): feat: add Eisenhower Matrix prioritization pattern

- Added a new Eisenhower Matrix prioritization pattern for task triage and decision-making.
- Renamed the pattern from `eisenhower` to `eisenhower_matrix` and removed the old pattern directory.
- Relocated the Eisenhower Matrix pattern into `data/patterns`.
- Registered the pattern's description and metadata with the BUSINESS, SELF, and STRATEGY tags.
- Added task classification and a weekly planning extract to the pattern.

Related Repositories