v1.0.154 v1.1.3

Name: YuE
Author: multimodal-art-projection

high risk

multimodal-art-projection/YuEOct 5, 2026 → Oct 5, 20260 days between releases

What's New

Security fix for XSS vulnerability in course document rendering

Breaking Changes

Slide HTML written via `/api/persistence` is stripped of scripts and inline styles.
Scripts, event handlers, and `javascript:` URLs are removed from persistence documents.

Improvements

Applied sanitization policy to `/api/persistence` on every write and read.
Fixed XSS vulnerability (GHSA-6c52-8h4v-5xvg) in course document rendering.

Bug Fixes

Resolved XSS vulnerability allowing arbitrary scripts in course documents served via `/api/persistence`.

Upgrade Notes

HTML content written via `/api/persistence` will now be sanitized, stripping scripts and inline styles. You may need to update your persistence logic to align with the renderer's formatting vocabulary.

The Two Releases

v1.0.154

Oct 5, 2026· 17 days ago

Minimal release notes: "**Full Changelog**: https://github.com/iOfficeAI/OfficeCLI/compare/v1.0.153...v1.0.154"

Full release notes

v1.1.3

OpenMAIC v1.1.3 — Security

Oct 5, 2026· 17 days ago

Security release addressing a Cross-Site Scripting (XSS) vulnerability in course documents served via `/api/persistence`, ensuring sanitized HTML is consistently applied.

Full release notes