Skip to content

1.0.121

Choose a tag to compare

View all tags
@nictuku nictuku released this 22 Sep 15:42
· 7 commits to main since this release
1.0.121
ceee65b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security: fixes GHSA-6v2r-2m4r-768m — reflected XSS in the local OAuth callback server error page, plus removal of the unauthenticated /token endpoint that could hand the stored authorization code to a same-origin page. Upgrade recommended for anyone using the interactive OAuth login flow. See SECURITY.md for operator action items.

What's changed

  • fix(security): HTML-escape the OAuth callback error parameter, add CSP/nosniff/frame-deny/no-referrer/no-store headers to every callback response, nonce the success page's inline script, and drop the unreferenced /token endpoint (#160). Also fixes the success branch always returning 500, so the authorization code is now actually stored.
  • chore(deps): bump mcp[cli] from 1.23.0 to 1.28.1 (#150).
  • chore(release): bump to 1.0.121 and document the advisory in SECURITY.md (#161).

Full changelog: 1.0.120...1.0.121

Assets 2
Loading