Timmy_Foundation/hermes-agent
16
0
Fork 0
Code Issues 38 Pull Requests 2 Actions 18 Packages Projects Releases Wiki Activity

[SECURITY] Validate CDP URLs to Prevent SSRF (V-010, CVSS 8.4) #65

Merged
allegro merged 1 commits from security/fix-browser-cdp into main 2026-03-30 23:57:28 +00:00
Conversation 0 Commits 1 Files Changed 1 +32
allegro commented 2026-03-30 23:57:25 +00:00
Member
Copy Link

Add URL validation for Chrome DevTools Protocol endpoints.

  • Only allow localhost and private networks
  • Block external URLs to prevent SSRF
  • Security logging for rejected URLs

Refs: V-010, CWE-918

Add URL validation for Chrome DevTools Protocol endpoints. - Only allow localhost and private networks - Block external URLs to prevent SSRF - Security logging for rejected URLs Refs: V-010, CWE-918
allegro added 1 commit 2026-03-30 23:57:25 +00:00
security: validate CDP URLs to prevent SSRF (V-010, CVSS 8.4)
Some checks failed
Supply Chain Audit / Scan PR for supply chain risks (pull_request) Successful in 27s
Details
Tests / test (pull_request) Failing after 25s
Details
Docker Build and Publish / build-and-push (pull_request) Failing after 37s
Details
cfaf6c827e 
Add URL validation before fetching Chrome DevTools Protocol endpoints.
Only allows localhost and private network addresses.

Changes:
- tools/browser_tool.py: Add hostname validation in _resolve_cdp_override()
- Block external URLs to prevent SSRF attacks
- Log security errors for rejected URLs

CVSS: 8.4 (High)
Refs: V-010 in SECURITY_AUDIT_REPORT.md
CWE-918: Server-Side Request Forgery
allegro merged commit 5936745636 into main 2026-03-30 23:57:28 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
assigned-claw-code
Queued for Code Claw (qwen/openrouter)
 assigned-kimi
Task assigned to KimiClaw for processing
 claw-code-done
Code Claw completed this task
 claw-code-in-progress
Code Claw is actively working
 epic
Epic - large feature with multiple sub-tasks
 gaming
Gaming agent capabilities
 kimi-done
KimiClaw has completed this task
 kimi-in-progress
KimiClaw is actively working on this
 mcp
MCP (Model Context Protocol) tools & servers
 morrowind
Morrowind Agent gameplay & MCP integration
 velocity-engine
Auto-generated by velocity engine
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
Rockachopa Timmy allegro antigravity bezalel claude claw-code codex-agent ezra gemini google grok groq hermes kimi manus perplexity
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Timmy_Foundation/hermes-agent#65
Delete Branch "security/fix-browser-cdp"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?