flyto-core

Security

• Fixes an SSRF guard bypass in which the IPv6 unspecified address :: could reach services listening on IPv6 loopback. IPv4 and IPv6 unspecified addresses, including expanded IPv6 spellings, are now rejected by the shared address classifier and URL guard.
• Affected versions: <= 2.27.0.
• Patched version: 2.28.0.
• Advisory: GHSA-gc4h-hj7x-gp5p.

Highlights

• Adds generic management for flyto-modules-* and flyto-plugin-* extensions, with authenticated install/uninstall routes, entry-point verification, rollback for failed new installs, and explicit restart requirements.
• Strengthens plugin policy checks, lifecycle synchronization, registry snapshot consistency, and capability-manifest refresh behavior.
• Keeps the generated tool catalog independent of locally installed third-party extensions.

Upgrade with:

python -m pip install --upgrade flyto-core==2.28.0

See the changelog for the full release details.

Registry-wide filesystem and outbound boundary coverage, enforced by tests rather than convention.

This is a minor, not a patch. Two changes refuse inputs earlier releases accepted:

• Paths outside FLYTO_SANDBOX_DIR (default: the process working directory) are refused by every module taking a caller-supplied path.
• Connections to private or link-local hosts require FLYTO_ALLOWED_HOSTS or FLYTO_ALLOW_PRIVATE_NETWORK=true. Loopback is unaffected, so self-hosted Redis/MySQL/SMTP on localhost keeps working.

See SECURITY_STATUS.md for every published advisory with the regression test covering it, and SECURITY.md for the environment variables that define both boundaries.

Minor rather than patch: the two boundary changes below refuse inputs that previous releases accepted, so this is not a drop-in upgrade for every caller. Read the Changed section before upgrading.

Security

• Closed the filesystem sandbox boundary across the whole module registry rather than one report at a time. A registry-wide audit found every remaining module that took a caller-supplied path to a filesystem sink without validate_path_with_env_config, and confined all of them: testing.visual.compare (diff_path, and the expected/actual read paths — this module declares no required_permissions, so the write was unauthenticated), data.xml.parse (file_path, the sibling GHSA-wc94-386q-5478 missed), browser.upload and aws.s3.upload (file_path — host files shipped to a remote origin), ssh.sftp_upload and ssh.sftp_download (local_path, the SFTP counterpart of GHSA-hmq9-xw4w-7ppc), file.delete (file_path — arbitrary file deletion), file.exists (path — filesystem oracle), git.clone (destination), git.commit/git.diff (repo_path), llm.code_fix (source_files, where the previous '..' substring check let absolute paths through), verify.spec (ruleset_path), plus docker.build, process.start and sandbox.execute_shell as hardening. None of these were reported; they are the same CWE-22 shape as the published advisories.
• Closed the outbound network boundary across the registry on the same basis. Added enforce_outbound_host and enforce_outbound_service_url to core/utils.py — the raw-TCP and non-HTTP-scheme counterparts of enforce_outbound_url, which only understands http(s) — and routed every module that reaches the network from a caller-supplied target through one of them: verify.run, verify.capture and verify.visual_diff (raw Playwright page.goto bypassing BrowserDriver._guard_navigation, and in visual_diff's case a bare playwright browser with no egress guard in any mode), browser.connect (ws_endpoint — CDP is remote code execution by design), browser.launch (proxy — the egress guard inspects request URLs, not where the proxy points), git.clone (url — the existing validator bounded the transport but never the destination), cache.* and queue.* (redis_url), db.mysql.query, db.redis.get/set, notification.email.send (smtp_server, which also carries SMTP credentials to whatever answers), ssh.exec/ssh.sftp_upload/ssh.sftp_download (host), network.ping, network.port_scan, network.traceroute, port.wait, and browser.emulate.
• Deduplicated the host resolver that GHSA-v7q9-pr72-5fmv was about. port.check carried the only correct implementation (IP literals range-checked directly so IPv6 transition forms cannot skip the check, and fail-closed on resolution failure); it now lives in core/utils.py as resolve_guard_ip and backs every host-taking module.
• Added tests/core/test_write_sink_coverage.py and tests/core/test_outbound_guard_coverage.py, which walk the module registry and fail the build if any module declares a p

Full Changelog: https://github.com/flytohub/flyto-core/compare/v2.26.10...v2.26.11

What's Changed

• Update README.md by @ChesterHsu in https://github.com/flytohub/flyto-core/pull/55

Full Changelog: https://github.com/flytohub/flyto-core/compare/v2.26.9...v2.26.10