v2026.08.27
huggingface/speech-to-speechv2026.08.27Aug 27, 2026by knu
Upgrading?
AI Summary
A critical security release addressing four vulnerabilities related to shell injection, OAuth binding, and event propagation.
Key Highlights
- Fixed shell command injection via crafted PdfInfoAgent event URLs.
- Prevented unauthorized OAuth service binding and manual event propagation.
- Resolved duplicate event delivery issues during concurrent propagation scans.
Breaking Changes
- Service-binding migration disconnects unauthorized private bindings and disables affected Agents.
New Features
- Security patches for command injection and authorization
- Duplicate delivery prevention
Full Release Notes
This security release fixes four issues: - A crafted PdfInfoAgent event URL could execute arbitrary shell commands even when insecure Agents were disabled. - An authenticated user could bind another user's private OAuth Service to an Agent, allowing the Agent to use the other user's stored OAuth credential. - An authenticated user could manually trigger event propagation across other users' Agents. - Concurrent propagation scans could deliver the same event more than once. The command-injection issue affects installations where untrusted users can create and connect Agents. The two authorization issues affect multi-user installations. The duplicate-delivery issue can affect any installation when propagation scans overlap and receivers perform non-idempotent work. Operators should upgrade promptly. The Service-binding migration disconnects unauthorized private bindings and disables affected Agents for administrator review. Full details: - https://github.com/huginn/huginn/security/advisories/GHSA-fc8p-86r3-g842 - https://github.com/huginn/huginn/security/advisories/GHSA-73v6-mq4f-33gw - https://github.com/huginn/huginn/security/advisories/GHSA-7824-m5cr-8pgj - https://github.com/huginn/huginn/security/advisories/GHSA-x7pc-rrfc-4chw **Full Changelog**: https://github.com/huginn/huginn/compare/v2022.08.18...v2026.08.27
Related Repositories
public-apis/public-apis★ 491,136
A collective list of free APIs
NousResearch/hermes-agent★ 255,969
The agent that grows with you
yt-dlp/yt-dlp★ 200,062
A feature-rich command-line audio/video downloader
microsoft/markitdown★ 191,491
Python tool for converting files and office documents to Markdown.
Significant-Gravitas/AutoGPT★ 187,703
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.