Stored XSS Vulnerability Fix and Security Patching Notes for earendi-work v0.78.1

Vulnerability Overview Stored XSS Vulnerability: A stored cross-site scripting (XSS) vulnerability was identified in HTML sessions. This occurred because control characters were not properly handled when sanitizing Markdown link and image URLs. Affected Scope All users of the project, particularly those who embed link and image URLs in Markdown content. Remediation Fix: In HTML session exports, sanitize Markdown link and image URLs by applying a scheme allow-list after stripping control characters. Specific Code: Other Related Fixes Other Fixes: - Fixed the installation of temporary extension packages to use the private directory with permissions , instead of . - Fixed git package source handling to reject unsafe host/path components and ensure that the managed clone path remains within the internal root directory. - Fixed the SDK embedded in bundles to gracefully handle a missing when it does not exist, using default values to enable without requiring adjacent package files at runtime. - Fixed HTTP timeout settings not being correctly respected by non-developer providers (such as llama.cpp via OpenAI-compatible APIs). The setting (configured via or ) now correctly disables SDK timeouts for all supported providers, not just OpenAI code responses. Disabling timeouts ( ) now correctly disables SDK timeouts for all supported providers by sending the maximum int32 value (effectively infinite) instead of 0, which caused the SDK to treat it as an immediate timeout. - Fixed inherited Amazon Bedrock requests by replacing blank required / text with placeholders and skipping block reply text blocks. - Fixed inherited Anthropic Claude Opus 4.7+ requests by suppressing the deprecated temperature parameter. - Fixed inherited OpenAI GPT-5.5 generated metadata by omitting the unsupported . - Fixed inherited OpenRouter Kimi K2.6 thinking replay and developer role instruction handling. - Fixed inherited OpenRouter reasoning instruction requests to preserve the system role when necessary. - Fixed inherited overlay focus restoration, ensuring non-capturing overlays remain interactive after UI rendering and explicit focus restoration. - Fixed inherited tab handling to consider column truncation and overlay composition, ensuring tab output content does not exceed terminal width. - Fixed opening and listing very large JSONL session files by reading session entries line by line, rather than materializing the entire file as a single string. - Fixed branch display for repositories in WSL, refreshing after branch changes. - Fixed the tool renderer to avoid outputting empty lines that leave blank spaces. - Restored inherited NVIDIA Qwen 3.5 122B NIM model support. Summary This page primarily describes multiple fixes in version v0.78.1 of the project, including the remediation of the stored XSS vulnerability and various other functional and security improvements.

Goal Reached Thanks to every supporter — we hit 100%!

Stored XSS Vulnerability Fix and Security Patching Notes for earendi-work v0.78.1

More from this source