Hinotoi-Agent

The local API server trusts the TCP peer address to bypass the `API AUTH KEY` bearer-token check for loopback clients and lacks Host header validation while binding to 0.0.0.0 with credentialed CORS by default. This allows a DNS-rebinding web page to issue authenticated requests to the local API as a trusted loopback client. Since loopback requests auto-enable shell tools, an attacker can access the 'POST /swarm/runs' endpoint using a built-in preset that permits the `bash` tool to achieve remote code execution as the API process user. Additionally, this bypass enables starting the live runner and overwriting LLM and data-source settings to redirect provider traffic and exfiltrate credentials.

An authorization bypass exists in the session export endpoint, allowing authenticated users to access sessions belonging to other profiles. The ` handle session export()` function in 'api/routes.py' does not verify ownership of the active profile before serializing session data. This allows attackers to exfiltrate session transcripts from other users by knowing or guessing session identifiers.

The software creates `response store.db` and `webhook subscriptions.json` files with world-readable permissions (mode 0o644). This configuration allows local users with filesystem access to read these files directly, exposing sensitive data such as conversation history, tool payloads, prompts, and per-route HMAC (Hash-based Message Authentication Code) secrets, which are used to verify the integrity and authenticity of messages.

A DNS rebinding issue in WebSocket endpoints allows remote attackers to bypass Host and Origin validation. This occurs because FastAPI HTTP middleware does not execute for WebSocket upgrade requests on the ' /api/pty', '/api/ws', '/api/pub', and '/api/events' endpoints. DNS rebinding is a technique where a malicious website tricks a browser into sending requests to a local or internal server by manipulating DNS records. This flaw enables attackers to inject malicious commands or read terminal output.

Improper redirect handling for Amp and Ollama provider sessions allows network attackers to intercept imported browser session cookies. This occurs when a provider-controlled redirect target issues a redirect to a cleartext HTTP endpoint within the same provider domain, enabling attackers positioned on the network path to receive the cookies in cleartext HTTP requests.

A denial of service issue exists in the Matrix channel media download handler. Authenticated room members can exhaust process memory and bandwidth by sending media events that lack or contain invalid size metadata. By sending multiple concurrent Matrix media events with omitted or invalid declared sizes, an attacker can trigger simultaneous large media downloads. These downloads fully materialize response bodies before they are rejected post-download, consuming system resources until service degradation occurs.

Insecure temporary file handling in the release notarization workflow allows local attackers to access sensitive credentials or tamper with build artifacts. This is possible by exploiting predictable file paths, enabling attackers on the same host to read the App Store Connect API key written to a fixed path. Additionally, attackers can pre-create files or symbolic links at predictable locations to redirect writes to attacker-controlled destinations or modify notarization archives before they are submitted.

An authentication bypass exists in the coordinator user-token verification path. The `verifyUserToken()` function fails to reject payloads containing an admin claim, which allows attackers to escalate privileges. An attacker with access to a shared non-admin token can craft a user-token payload with the `admin` variable set to `true`, sign it using HMAC-SHA256 (a cryptographic hash function used for verifying data integrity), and access admin-only coordinator routes. This provides full coordinator admin access, including lease visibility, pool state management, and forced release operations.

The software creates the daemon configuration directory and file using default filesystem permissions that may be world-readable on Unix-like systems. This allows local attackers to read the `~/.summarize/daemon.json` file, which contains bearer tokens and persisted provider API credentials. By exploiting these permissive permissions, an attacker can gain unauthorized access to the daemon or recover sensitive API keys.

An inconsistent Server-Side Request Forgery (SSRF) protection gap exists in the handling of Model Context Protocol (MCP) tool URLs. While direct preview and run endpoints reject internal or private network URLs, the endpoints used to create or update MCP tools allow the storage of internal MCP server URLs. These stored URLs can subsequently be used by the workflow execution process without further validation of the destination. An authenticated user with permissions to manage MCP toolsets can store an internal endpoint, such as `http://localhost:3000/mcp`, causing the backend workflow runner to connect to that internal destination.

A host/container filesystem boundary issue exists in outbound attachment handling and outbox cleanup. A compromised or prompt-injected container can read files outside the intended outbox directory by providing crafted `messages out.id` and `content.files` values or by creating symlinked outbox files. This can lead to host-side reads of arbitrary files and, in certain instances, recursive deletion of paths outside the intended cleanup target.

A path traversal issue in project deletion allows local attackers to recursively delete arbitrary directories. By supplying absolute paths that escape the configured `dir.projects` root directory, attackers can target project marker files outside the project storage boundary. This action results in the recursive deletion of chosen directories using the permissions of the radare2 process, leading to loss of integrity and availability.

An arbitrary file deletion issue exists in the '/api/session/delete' endpoint. Authenticated attackers can delete files outside the session directory by providing an absolute path or path traversal payload in the `session id` parameter. This occurs because unvalidated session identifiers allow the construction of paths that bypass the SESSION DIR boundary, enabling the deletion of writable JSON files on the host system.

Plugin lifecycle commands are exposed to remote senders by default. This allows attackers who gain access through the channel layer to remotely manage plugin trust and activation states, which can lead to unauthorized plugin installation and activation on the system. The affected API endpoints include '/plugin install', '/plugin enable', '/plugin disable', and '/reload-plugins'.

An authentication bypass exists in the VikingBot OpenAPI HTTP route surface. The issue occurs when the `api key` configuration value is unset or empty, causing the authentication check to fail open. Remote attackers with network access to the exposed service can invoke privileged bot-control functionality without providing a valid 'X-API-Key' header. This allows for the submission of attacker-controlled prompts, the creation or use of bot sessions, and unauthorized access to downstream tools, integrations, secrets, or data accessible to the bot.