mirror of
https://github.com/agent0ai/agent-zero.git
synced 2026-05-19 07:59:34 +00:00
b73da881c6
Bump FastMCP from 2.13.1 to 3.2.4 and MCP from 1.22.0 to 1.27.0 to remediate CVE-2026-32871 (GHSA-vv7q-7jx5-f767), as flagged by Docker Scout. Add a regression test covering OpenAPI path-parameter escaping so malicious values like ../../../admin/delete-all? remain percent-encoded under the intended route prefix instead of resolving to a different backend path. Validation: - smoke-tested Agent Zero MCP initialization against fastmcp 3.2.4 + mcp 1.27.0 - PYTHONPATH=/tmp/agent-zero-testdeps python3 -m pytest tests/test_fastmcp_openapi_security.py -q Refs: - CVE-2026-32871 - Docker Scout: https://scout.docker.com/vulnerabilities/id/CVE-2026-32871 - GitHub advisory: https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-vv7q-7jx5-f767 - Related upstream issue: https://github.com/agent0ai/agent-zero/issues/1526 |
||
|---|---|---|
| .. | ||
| chunk_parser_test.py | ||
| email_parser_test.py | ||
| rate_limiter_test.py | ||
| test_browser_agent_regressions.py | ||
| test_default_prompt_budget.py | ||
| test_dirty_json.py | ||
| test_docker_release_plan.py | ||
| test_extensions_stress.py | ||
| test_fasta2a_client.py | ||
| test_fastmcp_openapi_security.py | ||
| test_file_tree_visualize.py | ||
| test_git_version_label.py | ||
| test_http_auth_csrf.py | ||
| test_model_config_api_keys.py | ||
| test_multi_tab_isolation.py | ||
| test_persist_chat_log_ids.py | ||
| test_print_style.py | ||
| test_run_ui_config.py | ||
| test_self_update_tag_filter.py | ||
| test_settings_developer_sections.py | ||
| test_snapshot_parity.py | ||
| test_snapshot_schema_v1.py | ||
| test_socketio_library_semantics.py | ||
| test_socketio_unknown_namespace.py | ||
| test_state_monitor.py | ||
| test_state_sync_handler.py | ||
| test_state_sync_welcome_screen.py | ||
| test_stream_tool_early_stop.py | ||
| test_webui_extension_surfaces.py | ||
| test_whatsapp_bridge_manager.py | ||
| test_whatsapp_number_utils.py | ||
| test_whatsapp_storage_paths.py | ||
| test_ws_client_api_surface.py | ||
| test_ws_csrf.py | ||
| test_ws_handlers.py | ||
| test_ws_manager.py | ||
| test_ws_security.py | ||