Cairn
NousResearch/hermes-agent

WeCom/gateway file:// URL path traversal fixes

Cluster 8733 · gateway. Data as of

Nothing open on GitHub. Fix attempted, not merged.

The short answer

0open issues
0open PRs
3items grouped
Known?
Yes. 3 related items grouped here, 1 issue already closed.
Fix event
No fix has been merged to main. 2 PRs closed without merging; see the attempts below.
Tracker
The maintainers' tracker marks this unresolved. That is separate from the fix event.
Still open
Nothing open on GitHub.

A reported vulnerability and multiple fix attempts addressing arbitrary file read via file:// URL path traversal in the WeCom adapter and gateway. The fixes focus on sandboxing and validating local media file paths to restrict access.

Open issues0

No open issues.

Open PRs0

No open pull requests.

2 PRs closed without merging

From the close comments: closed without comment 1 · done elsewhere 1

  • #8747 fix(gateway): validate file:// media paths to prevent path traversal · closed without comment
  • #26424 fix(wecom): bound outbound local media paths · done elsewhere → #8733
Closed issues · 1
  • Closed#8733Arbitrary File Read via `file://` URL Path Traversal in WeCom Adapter
How this cluster was grouped
  • Link evidence (structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
  • Pairwise link density 0.67: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem
gateway
Closed issues
1
Attempts
2 PRs closed without merging

For your agent

The same facts, typed.

cluster/8733.json
cluster/8733.md