Starstruk Logo MarkStarstruk

v3.19.0

sinewaveai/agent-security-scanner-mcpv3.19.0Mar 15, 2026by sinewaveai

AI Summary

Addresses a critical ReDoS vulnerability and enhances Python taint analysis with AST-based fallback and cross-file capabilities.

Key Highlights

  • Fix for ReDoS vulnerability in prompt scanner
  • Python taint fallback using stdlib `ast`
  • Cross-file taint API with import-graph
  • Windows compatibility fixes

New Features

  • ReDoS vulnerability patch (190x faster)
  • Python AST-based taint analyzer
  • Inter-procedural propagation
  • With-statement sink detection

Full Release Notes

## Security Fixes
- **ReDoS vulnerability in prompt scanner** — Added windowed regex matching (`safeMatch`) that splits long inputs into overlapping 2KB chunks, capped base64 quantifiers, and added boundary anchors. **50KB input: 17s → 91ms (190x faster)**

## New Features
- **Python taint fallback** — stdlib `ast`-based taint analyzer for regex mode (no tree-sitter required), with inter-procedural propagation and with-statement sink detection
- **Cross-file taint API** — real import-graph + export-summary pipeline producing `cross-file-taint` findings with full taint paths

## Bug Fixes
- **Windows compatibility** — NamedTemporaryFile handle closed before unlink, backslash normalization in history paths
- **Fix templates** — downgraded 7 broken auto-fix patterns to safe manual-fix responses
- **Generic rules** — technology-scoped rules gated by language relevance to eliminate false positives
- **Semantic analysis** — cross-platform Python resolution and real capability check (verifies tree-sitter import)
- **scan-skill** — pre-realpath path traversal check, DRY pattern normalization
- **Flutter SDK packages** — treated as legitimate dart dependencies

## Test Results
- All 1325 tests pass
- Python interprocedural tests: 10/10
- Python AST engine tests: 5/5
- Prompt scanner + Garak validation: 36/36 (100% detection)

## Install
```bash
npm install -g agent-security-scanner-mcp@3.19.0
```

See [CHANGES.md](https://github.com/sinewaveai/agent-security-scanner-mcp/blob/main/CHANGES.md) for full details.