# Security Fixes - Version 2.1.56

**Release Date:** 2026-02-04  
**Type:** Security Patch  
**Severity:** Critical

---

## Summary

This release addresses critical security vulnerabilities discovered during a security audit. Multiple issues have been mitigated, and remaining vulnerabilities are documented for transparency.

---

## Fixed Vulnerabilities

### 1. 🔴 CRITICAL: Arbitrary Code Execution (CVE: Pending)

**Issue:** The `tools test` command allowed execution of arbitrary JavaScript code with access to file system, network, and crypto modules through Node's `vm` module.

**Impact:** 
- Remote code execution
- File system access (read/write/delete any file)
- Network requests to arbitrary hosts
- Data exfiltration

**Fix:**
- **Disabled tool execution entirely** in `src/index.ts`
- Tool testing now shows code preview only
- Added prominent security warning

**Files Changed:**
- `packages/os-cli/src/index.ts` (lines 2420-2476)

---

### 2. 🔴 CRITICAL: Path Traversal via Username

**Issue:** Usernames were not validated, allowing directory traversal attacks (e.g., `../../../etc/passwd`).

**Impact:**
- Read/write files outside `~/.4runr/` directory
- Potential system file access
- Unauthorized directory creation

**Fix:**
- **Added username validation** in `src/auth.ts`
- Only alphanumeric, underscore, hyphen allowed
- Rejects `..`, `/`, `\` characters
- Length limit: 1-64 characters
- Path resolution verification

**Files Changed:**
- `packages/os-cli/src/auth.ts` (new `validateUsername()` function)

---

### 3. 🟠 HIGH: Insecure File Permissions

**Issue:** Session files created with default permissions, readable by all users on the system.

**Impact:**
- Credential exposure to other users
- Session hijacking
- Information disclosure

**Fix:**
- **Set file mode to 0600** for session files
- Only owner can read/write
- Applies on Unix/Linux/macOS

**Files Changed:**
- `packages/os-cli/src/auth.ts` (`saveSession()` function)

---

### 4. Documentation & Warnings

**Added:**
- `SECURITY-AUDIT.md` - Comprehensive security audit report
- `SECURITY-WARNINGS.md` - User-facing security guide
- Enhanced README with security warnings
- Clear pre-MVP status disclaimer

**Files Changed:**
- `packages/os-cli/README.md`
- `packages/os-cli/SECURITY-AUDIT.md` (new)
- `packages/os-cli/SECURITY-WARNINGS.md` (new)
- `packages/os-cli/SECURITY-FIXES-2.1.56.md` (this file)

---

## Remaining Vulnerabilities

⚠️ **These issues are documented but NOT fixed in this release:**

1. **Command Injection** - Multiple `execSync` calls with potential for injection
2. **SSRF** - Gateway URL can target internal services
3. **Unencrypted Storage** - Credentials stored in plain text
4. **Missing Validation** - JSON parsing without schema validation
5. **Insecure Updates** - No integrity checks on npm updates

**See SECURITY-AUDIT.md for full details and mitigation plans.**

---

## Breaking Changes

### Tool Testing Disabled

**Before:**
```bash
4runr> tools test my-tool
Test input: {"data": "test"}
✓ Tool executed successfully
```

**After:**
```bash
4runr> tools test my-tool
⚠ SECURITY WARNING
Tool testing is currently disabled due to security concerns.
Tool code preview:
[shows code only, does not execute]
```

**Workaround:** Test tools in isolated environment (Docker, VM)

---

## Upgrade Instructions

### From 2.1.55 or earlier:

```bash
npm install -g 4runr-os@2.1.56
```

### New username restrictions:

If you have usernames with special characters, you'll need to use alphanumeric only:

**Valid:**
- `john_doe`
- `user123`
- `test-user`

**Invalid (will be rejected):**
- `../admin` (path traversal)
- `user@host` (special chars)
- `user name` (spaces)

---

## Security Best Practices

### For Users:

1. **Update immediately** if using 2.1.55 or earlier
2. **Review** SECURITY-AUDIT.md for remaining risks
3. **Do not** use in production
4. **Do not** run with admin/root privileges
5. **Do not** execute untrusted custom tools

### For Developers:

1. **Read** SECURITY-AUDIT.md for technical details
2. **Test** username validation in your integration
3. **Plan** for remaining vulnerability fixes
4. **Consider** professional security audit before MVP

---

## Timeline

- **2026-02-04:** Security vulnerabilities discovered
- **2026-02-04:** Patches developed and tested
- **2026-02-04:** Version 2.1.56 released
- **TBD:** Remaining vulnerabilities to be addressed

---

## Credits

Security audit and fixes by: 4Runr Security Team

---

## Contact

**Security Issues:** team@4runr.com  
**General Support:** GitHub Issues

**DO NOT** report security vulnerabilities in public GitHub issues.

---

## Verification

To verify this is version 2.1.56:

```bash
npm list -g 4runr-os
# or
4r --version
```

To verify fixes are applied:

```bash
# Check that tool testing is disabled
4r
> tools test any-tool
# Should show security warning, NOT execute

# Check username validation
4r
> connect ../../../test
# Should reject with validation error
```

---

## Changelog

### Version 2.1.56 (2026-02-04)

**Security:**
- 🔴 **CRITICAL:** Disabled arbitrary code execution in tool testing
- 🔴 **CRITICAL:** Added path traversal protection for usernames
- 🟠 **HIGH:** Improved file permissions for session files
- 📝 **DOCS:** Added comprehensive security documentation

**Other:**
- No functional changes
- No breaking changes (except tool testing)
- Updated README with security notices

---

**Status:** ✅ Released  
**Recommended:** ✅ Update immediately  
**Production Ready:** ❌ No (pre-MVP)
