fix(security): address vulnerabilities from security audit#1242

Merged

JinyuXiang-Mimo merged 11 commits into

XiaomiMiMo:mainfrom

JinyuXiang-Mimo:security/fix-file-read-vuln-v3

Jun 23, 2026

Commits on Jun 23, 2026

fix(security): address 25 vulnerabilities from security audit
JinyuXiang-Mimo
committed
fix(ssrf): handle hex-notation IPv4-mapped IPv6 addresses
JinyuXiang-Mimo
committed
fix(ssrf): allow loopback addresses for CLI tool use case
JinyuXiang-Mimo
committed
fix(security): address PR review findings
JinyuXiang-Mimo
committed
fix(test): use Response object for middleware next() return type
JinyuXiang-Mimo
committed
fix: SSRF redirect bypass, message truncation, Feishu replay & body parse
JinyuXiang-Mimo
committed
fix: add return type annotations to ssrf test fetch handlers
JinyuXiang-Mimo
committed
fix: retain HttpClient dependency in WebFetchTool to preserve Layer resolution
JinyuXiang-Mimo
committed
fix: revert webfetch to original HttpClient flow, add post-redirect SSRF check
JinyuXiang-Mimo
committed
fix: replace Bun.serve with fetch mocks in safeFetch tests
JinyuXiang-Mimo
committed
fix: use dependency injection in safeFetch to avoid globalThis.fetch pollution
JinyuXiang-Mimo
committed