What changed in huginn from 2022 to 2026

1 release numbered after v2022.08.18 up to and including v2026.08.27, stable releases only. v2022.08.18 and v2026.08.27 are the newest stable releases of 2022 and 2026 we track; this page follows them as new ones ship.

4 changes across 1 release

Security 4

v2026.08.27

  • Fix command injection vulnerability in PdfInfoAgent where a crafted event URL could execute arbitrary shell commands even when insecure Agents were disabled
  • Fix authorization vulnerability allowing an authenticated user to bind another user's private OAuth Service to an Agent
  • Fix authorization vulnerability allowing an authenticated user to manually trigger event propagation across other users' Agents
  • Fix duplicate event delivery issue caused by concurrent propagation scans delivering the same event more than once

Original release notes, newest first

The list above is our reading of these notes; the originals from huginn are here, one fold per release.

v2026.08.27

This security release fixes four issues:

  • A crafted PdfInfoAgent event URL could execute arbitrary shell commands even when insecure Agents were disabled.
  • An authenticated user could bind another user's private OAuth Service to an Agent, allowing the Agent to use the other user's stored OAuth credential.
  • An authenticated user could manually trigger event propagation across other users' Agents.
  • Concurrent propagation scans could deliver the same event more than once.

The command-injection issue affects installations where untrusted users can create and connect Agents. The two authorization issues affect multi-user installations. The duplicate-delivery issue can affect any installation when propagation scans overlap and receivers perform non-idempotent work. Operators should upgrade promptly. The Service-binding migration disconnects unauthorized private bindings and disables affected Agents for administrator review.

Full details:

Full Changelog: https://github.com/huginn/huginn/compare/v2022.08.18...v2026.08.27

View originalPermalink