5 releases 9 tags

RSS feed

• 1.5.3 08de137262

  Compare

  1.5.3 Stable

  eric released this 2026-07-01 17:04:37 -07:00 | 3 commits to main since this release

  v1.5.3 - Security fix: close remaining markdown injection gaps

  Follow-up security audit found the v1.5.2 markdown-escaping fix was incomplete — three call sites of the same injection pattern were missed. All three are fixed in this release.

  Fixed

  • Push commit messages could inject markdown links into push notifications. Any collaborator with ordinary push access could craft a commit message like Fix typo [Click here](https://evil.example/phish) and have it render as a clickable phishing link on markdown-aware notification targets (Discord, Mattermost, Telegram, Matrix, etc.).
  • Notification titles were never escaped, in any of the 28 event formatters — only body was. Attacker-controlled free text (release name, wiki page title, commit-status context, workflow/job name, package owner/label) could inject a masked link into the title. Confirmed exploitable against Mattermost unconditionally, and Telegram under this
    app's default NOTIFICATION_FORMAT=markdown.
  • link() didn't validate its URL argument. A crafted Gitea commit-status target_url (requires only ordinary repo write access, same tier as push) could break out of its markdown link and inject a second, fully attacker-controlled link plus fake bolded text into status notifications.

  Downloads

  • Source code (ZIP)
    3 downloads
  • Source code (TAR.GZ)
    3 downloads