v2026.08.27
Security 4
- Fix command injection vulnerability in PdfInfoAgent where a crafted event URL could execute arbitrary shell commands even when insecure Agents were disabled
- Fix authorization vulnerability allowing an authenticated user to bind another user's private OAuth Service to an Agent
- Fix authorization vulnerability allowing an authenticated user to manually trigger event propagation across other users' Agents
- Fix duplicate event delivery issue caused by concurrent propagation scans delivering the same event more than once
From huginn
This security release fixes four issues:
- A crafted PdfInfoAgent event URL could execute arbitrary shell commands even when insecure Agents were disabled.
- An authenticated user could bind another user's private OAuth Service to an Agent, allowing the Agent to use the other user's stored OAuth credential.
- An authenticated user could manually trigger event propagation across other users' Agents.
- Concurrent propagation scans could deliver the same event more than once.
The command-injection issue affects installations where untrusted users can create and connect Agents. The two authorization issues affect multi-user installations. The duplicate-delivery issue can affect any installation when propagation scans overlap and receivers perform non-idempotent work. Operators should upgrade promptly. The Service-binding migration disconnects unauthorized private bindings and disables affected Agents for administrator review.
Full details:
- https://github.com/huginn/huginn/security/advisories/GHSA-fc8p-86r3-g842
- https://github.com/huginn/huginn/security/advisories/GHSA-73v6-mq4f-33gw
- https://github.com/huginn/huginn/security/advisories/GHSA-7824-m5cr-8pgj
- https://github.com/huginn/huginn/security/advisories/GHSA-x7pc-rrfc-4chw
Full Changelog: https://github.com/huginn/huginn/compare/v2022.08.18...v2026.08.27