From 572c1882365fa3ae2927dc2f5985f604daeefc35 Mon Sep 17 00:00:00 2001 From: jdalton Date: Wed, 7 Oct 2026 20:46:44 -0400 Subject: [PATCH 1/2] docs: add security reporting policy and advisory upgrade guidance --- SECURITY.md | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000000..d6ce1454c1 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,38 @@ +# Security policy + +## Report a vulnerability privately + +Use [GitHub private vulnerability reporting](https://github.com/PerryTS/perry/security/advisories/new) +to report a suspected security vulnerability to the maintainers. Private reporting +is enabled for this repository. Do not put exploit details, credentials, or other +sensitive information in a public issue or pull request. + +Include the Perry version, operating system, affected command or API, a minimal +reproducer, and the security impact. For `perry publish`, include whether the hub +is hosted, remote self-hosted, or running on loopback. Redact tokens and secrets. + +## Updates and previously published advisories + +Use the latest stable [Perry release](https://github.com/PerryTS/perry/releases) +and review the [published security advisories](https://github.com/PerryTS/perry/security/advisories). +The versions below are the first patched versions listed in those advisories, +not a recommendation to stay on an old release. + +| Advisory | Issue | First patched version | +| --- | --- | --- | +| [GHSA-x55v-q459-68ch](https://github.com/PerryTS/perry/security/advisories/GHSA-x55v-q459-68ch) (CVE-2026-53777) | `perry publish` arbitrary file write through a server-controlled artifact name | 0.5.1159 | +| [GHSA-5324-c68v-8w62](https://github.com/PerryTS/perry/security/advisories/GHSA-5324-c68v-8w62) | Native JWT verification accepted expired tokens | 0.5.1166 | + +The publish fix rejects artifact names containing path traversal or path +separators and restricts the local-file copy shortcut to loopback hubs. Treat a +local hub as trusted: it can provide a local artifact path. + +The JWT expiry fix was followed by removal of the native `jsonwebtoken` binding. +Current Perry compiles the npm package from source. Upgrade Perry and rebuild +executables compiled with affected versions; updating the compiler does not +change an executable already distributed. Keep the application's npm dependencies +up to date as well. + +Published advisories remain visible on GitHub after fixes ship. Their presence +on the Security page is a historical record; consult each advisory's affected +and patched versions to determine whether an installation is affected. From 2da4ea2208744aaa15f2ec7179207f73ef966a9d Mon Sep 17 00:00:00 2001 From: jdalton Date: Wed, 7 Oct 2026 20:47:01 -0400 Subject: [PATCH 2/2] docs: add security policy changeset for #12180 --- changelog.d/12180-security-policy.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 changelog.d/12180-security-policy.md diff --git a/changelog.d/12180-security-policy.md b/changelog.d/12180-security-policy.md new file mode 100644 index 0000000000..a8808fc894 --- /dev/null +++ b/changelog.d/12180-security-policy.md @@ -0,0 +1,5 @@ +Added a discoverable security policy with GitHub private vulnerability reporting +instructions and upgrade guidance for the published artifact-path traversal and +JWT expiration advisories. Documents their existing patched versions, the need +to rebuild affected compiled executables, and why published advisory records +remain visible after fixes ship. No runtime behavior changes.