huginn

This security release fixes three issues:

• A Scenario description containing HTML could execute script in the browser of a user importing the Scenario, both in the import preview and after the import. Scenario icons were likewise stored without validation.
• Any authenticated user could read any file readable by the Huginn process by handing a file pointer to a file-consuming Agent, even with ENABLE_INSECURE_AGENTS disabled. Reading .env exposes APP_SECRET_TOKEN, which allows forging an administrator session.
• Pages served by LiquidOutputAgent, DataOutputAgent and other web request handlers ran on Huginn's own origin, so a page authored by one user could act on Huginn as another user viewing it.

The file-read issue affects installations where untrusted users have accounts. Operators of such installations should rotate APP_SECRET_TOKEN and any other secrets stored in .env after upgrading, since a secret leaked before the fix remains usable. The Scenario import issue affects anyone importing a Scenario from an untrusted source. The web request issue affects multi-user installations. Operators should upgrade promptly.

Responses from the web request route now carry Content-Security-Policy: sandbox allow-scripts allow-forms allow-popups. Pages that relied on calling Huginn's own API from within a served page will stop working.

This release also hardens deployment defaults:

• The Docker configurations no longer ship a fixed APP_SECRET_TOKEN. A random one is generated on container start unless APP_SECRET_TOKEN is set; set it to a value of your own to keep sessions valid across container restarts. Deployments still supplying the previously shipped value get a warning and a generated secret instead.
• rake db:seed generates a random admin password and prints it once unless SEED_PASSWORD is set.
• DataOutputAgent and LiquidOutputAgent get a random default secret.
• Devise paranoid mode is enabled, so the password reset, unlock and confirmation forms no longer reveal whether an account exists.
• TwitterStreamAgent is retired, as the Twitter streaming API it depended on was shut down in 2023. Existing Agents remain loadable but new ones cannot be created.

Full details:

• https://github.com/huginn/huginn/security/advisories/GHSA-x738-j22q-h2jw
• https://github.com/huginn/huginn/security/advisories/GHSA-p347-7m45-694r
• https://github.com/huginn/huginn/security/advisories/GHSA-p748-5grc-mcf5

Full Changelog: https://github.com/huginn/huginn/compare/v2026.08.27...v2026.09.08

This security release fixes four issues:

• A crafted PdfInfoAgent event URL could execute arbitrary shell commands even when insecure Agents were disabled.
• An authenticated user could bind another user's private OAuth Service to an Agent, allowing the Agent to use the other user's stored OAuth credential.
• An authenticated user could manually trigger event propagation across other users' Agents.
• Concurrent propagation scans could deliver the same event more than once.

The command-injection issue affects installations where untrusted users can create and connect Agents. The two authorization issues affect multi-user installations. The duplicate-delivery issue can affect any installation when propagation scans overlap and receivers perform non-idempotent work. Operators should upgrade promptly. The Service-binding migration disconnects unauthorized private bindings and disables affected Agents for administrator review.

Full details:

• https://github.com/huginn/huginn/security/advisories/GHSA-fc8p-86r3-g842
• https://github.com/huginn/huginn/security/advisories/GHSA-73v6-mq4f-33gw
• https://github.com/huginn/huginn/security/advisories/GHSA-7824-m5cr-8pgj
• https://github.com/huginn/huginn/security/advisories/GHSA-x7pc-rrfc-4chw

Full Changelog: https://github.com/huginn/huginn/compare/v2022.08.18...v2026.08.27

What's Changed

• Mismatched ruby versions - updated to 2.6.9 by @2600box in https://github.com/huginn/huginn/pull/3058
• Drop BasecampAgent by @knu in https://github.com/huginn/huginn/pull/3056
• made mysql flush appear as code by @2600box in https://github.com/huginn/huginn/pull/3059
• Migrate from RR to RSpec Mocks by @knu in https://github.com/huginn/huginn/pull/3066
• fix error 'tried to create Proc object without a block' in Gemfile by @JaHIY in https://github.com/huginn/huginn/pull/3097
• Upgrade mini_racer to the latest version by @knu in https://github.com/huginn/huginn/pull/3103
• Add a Liquid variable referring to the agent itself as _agent_ by @knu in https://github.com/huginn/huginn/pull/3104
• Force setup_heroku to use heroku-18 stack by @nighthawk in https://github.com/huginn/huginn/pull/3124
• Update gems for ruby 2.7 by @knu in https://github.com/huginn/huginn/pull/3130
• Upgrade Ruby to 2.7 by @knu in https://github.com/huginn/huginn/pull/3055
• Fix ImapFolderAgent documentation regarding mime_types by @axsuul in https://github.com/huginn/huginn/pull/3146

New Contributors

• @2600box made their first contribution in https://github.com/huginn/huginn/pull/3058
• @JaHIY made their first contribution in https://github.com/huginn/huginn/pull/3097
• @nighthawk made their first contribution in https://github.com/huginn/huginn/pull/3124

Full Changelog: https://github.com/huginn/huginn/compare/v2022.01.04...v2022.08.18