Skip to content

Security advisories

One record per fixed vulnerability in CodeNavi, newest first. Each carries the five elements a fixed-vulnerability disclosure needs: what it was, which versions it affected, the impact, the severity, and what to do. Severity words follow CVSS 3.1 (Critical ≥ 9.0, High 7.0–8.9, Medium 4.0–6.9, Low < 4.0); dependency fixes carry the upstream CVE identifiers instead of a CodeNavi score.

Advisory identifiers are CN-SA-YYYY-NNN and never change once issued. The release that ships a fix names the advisory in its release notes Security section, and this page is the index. Hardening — a control added where none was missing — is listed in the release notes only, with no advisory.

To report a vulnerability, see Vulnerability disclosure. Machine-readable contact: /.well-known/security.txt on every instance.

Advisory Published Fixed in Severity Summary
CN-SA-2026-006 2026-10-09 1.3.50 Critical (upstream CVE) Python 3.12.14 in the container image: a TLS server whose sni_callback swaps the socket's context could crash or use freed memory
CN-SA-2026-005 2026-10-05 1.3.46 Critical (upstream CVEs) Python sentence-transformers and PyJWT libraries in the container image carried Critical-severity CVEs
CN-SA-2026-004 2026-09-28 1.3.44 Critical (upstream CVE) Python anyio library in the container image could accept a spoofed TLS certificate for an internationalized host name
CN-SA-2026-003 2026-09-13 1.3.39 Critical (upstream CVEs) Debian packages in the container image with Critical-severity CVEs that had fixes available
CN-SA-2026-002 2026-08-22 1.3.15 Medium — CVSS 3.1 5.3 DNS-rebinding reach into a tokenless loopback server from a web page
CN-SA-2026-001 2026-08-22 1.3.15 High — CVSS 3.1 7.2 Settings API accepted any hook-script directory, a configuration-to-execution path for a token holder

CN-SA-2026-006

Container image shipped Python 3.12.14, which has a Critical-severity CVE in its ssl module.

  • Affected: the server image of every release up to and including 1.3.49.
  • Impact: in Python before 3.12.15, a remote TLS client can make a server crash or call through a freed pointer when the server's sni_callback assigns a different context to SSLSocket.context and nothing else keeps the original ssl.SSLContext alive (CVE-2026-19445). TLS clients are not affected. CodeNavi does not use this path: the server speaks plain HTTP (TLS is terminated by your reverse proxy, if you use one), and no code in the image — CodeNavi's or a bundled library's — sets an sni_callback. The vulnerable code was present, and an audit of the image would list it.
  • Severity: Critical, per the upstream rating — CVSS 4.0 (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N).
  • Fixed in: 1.3.50 — the python:3.12-slim base moved to Python 3.12.15. The CVE reached the vulnerability database after the 1.3.49 release check; the check refuses a release while a Critical finding with an available fix remains.
  • Action: update to 1.3.50 or later (update.sh). No configuration change.

CN-SA-2026-005

Container image shipped sentence-transformers and PyJWT versions with Critical-severity CVEs.

  • Affected: the server image of every release up to and including 1.3.45.
  • Impact: sentence-transformers before 5.6.0 runs Python files from a local model folder even when model code is switched off (trust_remote_code=False) (CVE-2026-68770, GHSA-jhr6-gm9c-rqjv). In CodeNavi this matters only if you set CODE_EMBEDDING_TRUST_REMOTE_CODE=false and point the embedding model setting at a folder that someone else can write to. The bundled embedding model and the bundled search reranker are not affected. PyJWT up to 2.13.0 can accept a forged token when an application allows both an HMAC and an asymmetric signing algorithm (CVE-2026-102268, GHSA-ffc3-869f-jxw9). CodeNavi does not verify JWTs — its API uses a bearer token — so this path is not used; the library is present only as a dependency of the MCP SDK.
  • Severity: Critical, per the upstream ratings — sentence-transformers CVSS 4.0 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N); PyJWT CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
  • Fixed in: 1.3.46 — sentence-transformers 5.6.0 and PyJWT 2.14.0. Found by the release CVE check, which refuses a release while a Critical finding with an available fix remains.
  • Action: update to 1.3.46 or later (update.sh). No configuration change.

CN-SA-2026-004

Container image shipped an anyio version with a Critical-severity TLS host-name CVE.

  • Affected: the server image of every release up to and including 1.3.43.
  • Impact: anyio before 4.14.2 encodes internationalized (non-ASCII) host names with IDNA 2003 when it opens a TLS connection, so a party able to intercept that connection could present a certificate for the IDNA 2003 form of the name and have it accepted (CVE-2026-63374, GHSA-82r6-8w77-94w6). In CodeNavi the only outbound connections made through anyio are the opt-in web crawler's: its page fetches, login step and form submissions. Host names written only in ASCII — every default endpoint and most sites — are not affected, and the crawler is off unless you enable it.
  • Severity: Critical, per the upstream rating — CVSS 4.0 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N).
  • Fixed in: 1.3.44 — anyio 4.14.2. Found by the release CVE check, which refuses a release while a Critical finding with an available fix remains.
  • Action: update to 1.3.44 or later (update.sh). No configuration change.

CN-SA-2026-003

Container image shipped Debian packages with Critical-severity CVEs that had fixes available.

  • Affected: the server image of every release up to and including 1.3.37 (1.3.38 was superseded by 1.3.39 the same day).
  • Impact: the C library, Perl and OpenSSL inside the image were the base image's versions, behind Debian's security releases. Reachability from the network is limited — the server runs as an unprivileged user in a read-only, capability-dropped container and exposes one HTTP port — but the vulnerable code was present and an audit of the image would list it.
  • Severity: Critical, per the upstream CVE ratings. 34 Critical-severity findings with an available fix on the 1.3.37 image; 0 on 1.3.39. The full finding list is the Grype record kept beside the release SBOM (sbom.json) and is available to customers on request.
  • Fixed in: 1.3.39 — libc6 2.41-12+deb13u4, perl 5.40.1-6+deb13u1, openssl 3.5.7-1~deb13u2, and the python:3.12-slim base moved to its 2026-09 digest. Every release since is refused at build time while a Critical finding with an available fix remains.
  • Action: update to 1.3.39 or later (update.sh). No configuration change.

CN-SA-2026-002

DNS rebinding could reach a tokenless loopback server from a web page.

  • Affected: every release up to and including 1.3.14, only when running on loopback with no CODENAVI_AUTH_TOKEN set. Every install made by the installer sets a token and is not affected.
  • Impact: a web page opened in a browser on the same machine could, through DNS rebinding, address the local MCP endpoint and read from the index. Requires the victim to open an attacker-controlled page and the server to be running without a token.
  • Severity: Medium — CVSS 3.1 5.3 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).
  • Fixed in: 1.3.15 — the MCP transport's Host/Origin check is enabled for exactly this posture (tokenless loopback). With a token set the check stays off, because it would refuse legitimate LAN and port-forwarded clients while adding nothing the token does not already provide.
  • Action: update to 1.3.15 or later, or set a bearer token — either closes it.

CN-SA-2026-001

The settings API accepted any absolute path as the hook-script directory.

  • Affected: every release up to and including 1.3.14.
  • Impact: a caller holding the bearer token could point HOOK_SCRIPT_DIR at any directory over the HTTP settings API; the server then ran <dir>/<event>.sh on the next event. That turns configuration access into process execution inside the container. The token already grants the whole tool surface, and the container is read-only with all capabilities dropped, which bounds what such execution reaches.
  • Severity: High — CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
  • Fixed in: 1.3.15 — the HTTP write path is pinned to the documented /app/hooks mount. The environment variable and a hand-edited data/settings.json still accept any path by design: the boundary is "arrived over the network", not "owns the machine".
  • Action: update to 1.3.15 or later. If your token may have been exposed before updating, rotate it (CODENAVI_AUTH_TOKEN in .env, then restart).

No install is known to have been affected by CN-SA-2026-001 or -002; both were found by our own audit against a published advisory for another MCP server.