Unverified50% confidenceSolutionExact time
The new version fixes a secret leakage issue where plugin and marketplace error messages displayed tokens or passwords in git source URLs, as well as an issue where /mcp and /plugin server details displayed secrets resolved from ${VAR} placeholders.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
9/11/2026
First Seen
Valid until: 12/10/2026
Sources
Related Entities
Related Claims
Unverified怀疑执行过恶意版本后应默认所有敏感凭证（npm token、云服务密钥、Git/SSH凭证、CI secret）已泄露并立即轮换60% similarUnverifiedGit 2.34+ 支持 SSH 密钥签名（gpg.format=ssh），降低了密钥管理门槛59% similarUnverified通过 Google Drive 分发源码难以建立与 Git 签名标签同等级别的密码学信任链，构成软件供应链安全隐患59% similarUnverifiedPreviously, deny and ask permission rules would fail on symlinked directories such as /etc, /tmp, and /var on macOS and /bin on Linux; the new version fixes this symlink permission bypass vulnerability.58% similarUnverified2013年Rapid7研究员HD Moore发布的《Security Flaws in Universal Plug and Play》报告揭示了UPnP的系统性缺陷，包括libupnp和MiniUPnP库的远程代码执行漏洞57% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/896666API
curl https://kongchang.com/api/v1/knowledge/claims/896666MCP
get_claim(id=896666)