v2026.08.27
vectorize-io/hindsightv2026.08.27Aug 27, 2026by knu
Upgrading?
AI Summary
This is a critical security release fixing four vulnerabilities: command injection in PdfInfoAgent, unauthorized OAuth Service binding, unauthorized event propagation, and duplicate event delivery in concurrent scans.
Key Highlights
- Fixed command injection vulnerability in PdfInfoAgent
- Fixed unauthorized OAuth Service binding and event propagation
- Fixed duplicate event delivery in concurrent scans
- Added Service-binding migration for unauthorized bindings
New Features
- Security hardening (command injection fix)
- OAuth binding fix
- Duplicate delivery fix
- Service-binding migration
Full Release Notes
This security release fixes four issues: - A crafted PdfInfoAgent event URL could execute arbitrary shell commands even when insecure Agents were disabled. - An authenticated user could bind another user's private OAuth Service to an Agent, allowing the Agent to use the other user's stored OAuth credential. - An authenticated user could manually trigger event propagation across other users' Agents. - Concurrent propagation scans could deliver the same event more than once. The command-injection issue affects installations where untrusted users can create and connect Agents. The two authorization issues affect multi-user installations. The duplicate-delivery issue can affect any installation when propagation scans overlap and receivers perform non-idempotent work. Operators should upgrade promptly. The Service-binding migration disconnects unauthorized private bindings and disables affected Agents for administrator review. Full details: - https://github.com/huginn/huginn/security/advisories/GHSA-fc8p-86r3-g842 - https://github.com/huginn/huginn/security/advisories/GHSA-73v6-mq4f-33gw - https://github.com/huginn/huginn/security/advisories/GHSA-7824-m5cr-8pgj - https://github.com/huginn/huginn/security/advisories/GHSA-x7pc-rrfc-4chw **Full Changelog**: https://github.com/huginn/huginn/compare/v2022.08.18...v2026.08.27
Related Repositories
public-apis/public-apis★ 491,128
A collective list of free APIs
NousResearch/hermes-agent★ 255,901
The agent that grows with you
yt-dlp/yt-dlp★ 200,002
A feature-rich command-line audio/video downloader
microsoft/markitdown★ 191,481
Python tool for converting files and office documents to Markdown.
Significant-Gravitas/AutoGPT★ 187,700
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.