guardvibe 3.1.30 → 3.1.32

package/CHANGELOG.md

@@ -5,6 +5,23 @@ All notable changes to GuardVibe are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.1.32] - 2026-06-06
+
+### Added — 4 new CVE rules (429 → 433), sourced via `npm run intel`
+First rules added through the new intel-gap workflow: the daily check surfaced these as uncovered HIGH/CRITICAL npm advisories, each was written + tested + passed `npm run gate`.
+- **VG1076** vitest < 4.1.0 — UI/API server arbitrary file read & execute (CVE-2026-47429, GHSA-5xrq-8626-4rwp, critical)
+- **VG1077** @vitest/browser 4.0.17–4.1.5 + 5.0.0-beta.0→beta.2 — inline-script XSS via unsanitized `otelCarrier` query param (CVE-2026-47428, GHSA-2h32-95rg-cppp, critical)
+- **VG1078** liquidjs < 10.26.0 — remote code execution via attacker-influenced templates (CVE-2026-45618, GHSA-gf2q-c269-pqgc, critical)
+- **VG1079** tinymce < 5.11.1 / 6.0.0→7.9.2 / 8.0.0→8.5.0 — stored/DOM XSS cluster incl. media-plugin `data-mce-object` injection (CVE-2026-47759/47760/47761/47762, high)
+
+CVE-version intelligence count 63 → 67. Tests +24. Self-audit PASS A 100.
+
+## [3.1.31] - 2026-06-06
+
+### Added — daily intel-gap triage
+- **`npm run intel`** (`scripts/intel-check.mjs`) — pulls recently-published reviewed npm advisories from the GitHub Advisory Database and cross-references each against GuardVibe's existing coverage (every CVE id, GHSA id, and package name in `src/data/rules/`). Reports HIGH/CRITICAL advisories not yet covered — the candidate list for new rules. Flags: `--since <days>`, `--json`. Read-only; never writes rules or commits.
+- **Daily scheduled workflow** (`.github/workflows/intel.yml`) — runs the gap check every morning and posts the report to the Actions step summary (no issue spam, injection-safe, `contents: read` only). The deliberate safe replacement for the old auto-update routine that committed untested rules: discovery is automated, but new rules are still written by a human and must pass `npm run gate` before release.
+
 ## [3.1.30] - 2026-06-06
 
 ### Added — release-integrity foundation

package/README.md

@@ -6,7 +6,7 @@
 [![npm provenance](https://img.shields.io/badge/provenance-verified-brightgreen)](https://www.npmjs.com/package/guardvibe)
 [![codecov](https://codecov.io/gh/goklab/guardvibe/graph/badge.svg)](https://codecov.io/gh/goklab/guardvibe)
 
-**The security MCP built for vibe coding.** 429 security rules, 36 tools covering the entire AI-generated code journey — from first line to production deployment.
+**The security MCP built for vibe coding.** 433 security rules, 36 tools covering the entire AI-generated code journey — from first line to production deployment.
 
 Works with **Claude Code, Cursor, Gemini CLI, Codex, VS Code (Copilot), Windsurf**, and any MCP-compatible coding agent.
 
@@ -14,11 +14,11 @@ Works with **Claude Code, Cursor, Gemini CLI, Codex, VS Code (Copilot), Windsurf
 
 Most security tools are built for enterprise security teams. GuardVibe is built for **you** — the developer using AI to build and ship web apps fast.
 
-- **429 security rules, 36 tools** purpose-built for the stacks AI agents generate
+- **433 security rules, 36 tools** purpose-built for the stacks AI agents generate
 - **Zero setup friction** — `npx guardvibe` and you're scanning
 - **No account required** — runs 100% locally, no API keys, no cloud
 - **Understands your stack** — not generic SAST, but rules that know Next.js, Supabase, Stripe, Clerk, and the tools you actually use
-- **CVE version intelligence** — detects 63 known vulnerable package versions in package.json, refreshed every day from GHSA / OSV.dev / CISA KEV
+- **CVE version intelligence** — detects 67 known vulnerable package versions in package.json, refreshed every day from GHSA / OSV.dev / CISA KEV
 - **AI agent & MCP security** — detects MCP server vulnerabilities, tool-description prompt injection (OWASP MCP Top 10), model-controlled sandbox-disable flags, excessive AI permissions, indirect prompt injection
 - **Auto-fix suggestions** — `fix_code` tool returns concrete patches and structured edits the AI agent can apply mechanically. Coverage: hardcoded credentials → env-var migration; public-prefix LLM keys (`NEXT_PUBLIC_/VITE_/EXPO_PUBLIC_/REACT_APP_`) → prefix removal; CORS wildcards → env allowlist; `dangerouslyAllowBrowser` flags → drop; sandbox bypass flags (`unsafe`/`noSandbox`/`allowEval`) → drop; agent loops → add `maxSteps`; raw-HTML React props → `<ReactMarkdown>`; missing auth checks → insert auth guard; SQL injection → parameterized queries; missing rate limiters / CSRF / security headers → snippet templates.
 - **Pre-commit hook** — block insecure code before it reaches your repo
@@ -49,10 +49,10 @@ GuardVibe is purpose-built for the AI coding workflow. Traditional tools are exc
 | AI/LLM security (prompt injection, MCP, tool abuse) | 68 rules | Experimental/None | None |
 | AI host security (CVE-2025-59536, CVE-2026-21852) | `guardvibe doctor` | Not supported | Not supported |
 | Auto-fix suggestions for AI agents | `fix_code` tool | CLI autofix | Not supported |
-| CVE version detection | 63 packages, refreshed daily | Extensive | Extensive |
+| CVE version detection | 67 packages, refreshed daily | Extensive | Extensive |
 | Compliance mapping (SOC2, PCI-DSS, HIPAA) | Built-in | Paid tier | None |
 | SARIF CI/CD export | Yes | Yes | Limited |
-| Rule count | 429 (focused, 68 AI-native) | 5000+ (broad) | N/A |
+| Rule count | 433 (focused, 68 AI-native) | 5000+ (broad) | N/A |
 
 **When to use GuardVibe:** You're building with AI agents and want security scanning integrated into your coding workflow — no dashboard, no account, no CI setup.
 
@@ -176,7 +176,7 @@ React Native, Expo — AsyncStorage secrets, deep link token exposure, hardcoded
 ### Firebase
 Firestore security rules, Firebase Admin SDK exposure, storage rules, custom token validation
 
-### CVE Version Intelligence (63 CVEs, refreshed daily)
+### CVE Version Intelligence (67 CVEs, refreshed daily)
 **Frameworks:** Next.js (CVE-2024-34351, CVE-2024-46982, CVE-2025-29927, CVE-2026-23869, CVE-2026-44573 / 44574 / 44575 / 44578 / 44579 / 45109 May 2026 cluster), React + react-server-dom-* (CVE-2025-55182, CVE-2026-23870), Express, Hono pre-4.12.18 cluster, @vitejs/plugin-rsc, Strapi content-type-builder (CVE-2026-22599)
 **Auth:** Clerk middleware bypass (GHSA-vqx2), Clerk `has()` org/billing/reverification bypass (GHSA-w24r), Clerk `clerkFrontendApiProxy` SSRF (CVE-2026-34076), NextAuth.js (2 CVEs), jsonwebtoken
 **ORMs / SQL:** Drizzle SQL identifier injection (CVE-2026-39356) + Drizzle `sql.raw` interpolation (VG1073), MikroORM SQL injection (CVE-2026-44680), Prisma raw-query call-form, Kysely JSON-path traversal (CVE-2026-44635)
@@ -242,7 +242,7 @@ Malicious postinstall scripts, unpinned GitHub Actions, CI `npm` provenance / `-
 
 All scanning tools support `format: "json"` for machine-readable output.
 
-## Security Rules (429 rules across 25 modules)
+## Security Rules (433 rules across 25 modules)
 
 | Category | Rules | Coverage |
 |----------|-------|----------|
@@ -457,7 +457,7 @@ If your AI agent cannot connect to GuardVibe:
 
 1. **Restart your IDE/agent.** MCP servers are started by the host application. After running `npx guardvibe init`, restart Claude Code, Cursor, or Gemini CLI for the config to take effect.
 2. **Check the config path.** Run `npx guardvibe init claude` again and verify the output shows the correct config file location (`.mcp.json` in your project root for Claude Code, `.cursor/mcp.json` for Cursor).
-3. **Re-run `init` to upgrade.** When upgrading GuardVibe, re-run `npx guardvibe init claude` — `.mcp.json` is pinned to a specific version (e.g. `guardvibe@3.1.30`) at init time for fast deterministic startup. As of v3.1.2 the re-run also rewrites stale pins automatically (`Upgraded GuardVibe pin (3.1.27 → 3.1.28)`); since v3.1.27 the PostToolUse hook command is pinned to the same version (was `@latest`) and re-run upgrades a stale hook too. The same applies to `npx guardvibe hook install` and `npx guardvibe ci github` (since v3.1.3) — both are version-pinned at install/generate time and re-run to upgrade.
+3. **Re-run `init` to upgrade.** When upgrading GuardVibe, re-run `npx guardvibe init claude` — `.mcp.json` is pinned to a specific version (e.g. `guardvibe@3.1.32`) at init time for fast deterministic startup. As of v3.1.2 the re-run also rewrites stale pins automatically (`Upgraded GuardVibe pin (3.1.27 → 3.1.28)`); since v3.1.27 the PostToolUse hook command is pinned to the same version (was `@latest`) and re-run upgrades a stale hook too. The same applies to `npx guardvibe hook install` and `npx guardvibe ci github` (since v3.1.3) — both are version-pinned at install/generate time and re-run to upgrade.
 4. **Pre-3.1.1 users won't see the auto-update banner.** GuardVibe started writing a once-per-day "newer version available" notice to stderr in v3.1.1. If your install predates that, you'll never see it — run `npx -y guardvibe@latest init <host>` once to bake in the latest pin and start receiving banners on subsequent sessions.
 5. **Verify Node.js version.** GuardVibe requires Node.js >= 18.0.0. Check with `node --version`.
 6. **Check npx cache.** If you upgraded GuardVibe and the old version is cached, run `npx -y guardvibe@latest` to force the latest version.

package/build/data/rules/cve-versions.js

@@ -733,4 +733,52 @@ export const cveVersionRules = [
         fixCode: '// package.json\n"overrides": { "node-ipc": "^12.0.0" }\n\n// pnpm-only\n// "pnpm": { "overrides": { "node-ipc": "^12.0.0" } }\n\n// yarn classic / berry\n// "resolutions": { "node-ipc": "^12.0.0" }',
         compliance: ["SOC2:CC7.1", "SOC2:CC8.1", "PCI-DSS:Req6.2"],
     },
+    {
+        id: "VG1076",
+        name: "Vitest UI Server Arbitrary File Read/Execute (CVE-2026-47429 / GHSA-5xrq-8626-4rwp)",
+        severity: "critical",
+        owasp: "A01:2025 Broken Access Control",
+        description: "vitest before 4.1.0 ships a UI/API server that, when listening, lets an attacker on the same network (or via a browser request when the dev server is exposed) read and execute arbitrary files on the developer or CI host. Vitest is a near-ubiquitous test runner, so a vulnerable pin in devDependencies exposes any machine that runs `vitest --ui` or leaves the API server bound during CI.",
+        pattern: /["']vitest["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:[0-3]\.\d+\.\d+|4\.0\.\d+)["']/g,
+        languages: ["json"],
+        fix: "Upgrade vitest to 4.1.0+: npm install -D vitest@latest. Never expose the Vitest UI/API server beyond localhost, and bind it to 127.0.0.1 in CI rather than 0.0.0.0.",
+        fixCode: '// package.json\n"vitest": "^4.1.0"  // or latest\n\n// vitest.config — keep the API/UI local-only\nexport default { test: { api: { host: "127.0.0.1" } } };',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG1077",
+        name: "Vitest Browser Mode Inline-Script XSS via otelCarrier (CVE-2026-47428 / GHSA-2h32-95rg-cppp)",
+        severity: "critical",
+        owasp: "A02:2025 Injection",
+        description: "@vitest/browser 4.0.17 through 4.1.5 (and the 5.0.0-beta.0 -> 5.0.0-beta.2 line) serves the `otelCarrier` query parameter back as an unsanitized inline script in browser mode. An attacker who can influence the URL of the running browser-mode session achieves cross-site scripting / arbitrary script execution in the test browser context, which on CI can pivot to the runner.",
+        pattern: /["']@vitest\/browser["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:4\.0\.(?:1[7-9]|[2-9]\d)|4\.1\.[0-5]|5\.0\.0-beta\.[0-2])["']/g,
+        languages: ["json"],
+        fix: "Upgrade @vitest/browser to 4.1.6+ (stable) or 5.0.0-beta.3+ (beta): npm install -D @vitest/browser@latest. Keep browser-mode sessions on localhost only.",
+        fixCode: '// package.json\n"@vitest/browser": "^4.1.6"  // or latest',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.7"],
+    },
+    {
+        id: "VG1078",
+        name: "LiquidJS Remote Code Execution (CVE-2026-45618 / GHSA-gf2q-c269-pqgc)",
+        severity: "critical",
+        owasp: "A03:2025 Injection",
+        description: "liquidjs before 10.26.0 is vulnerable to remote code execution when rendering templates whose content or context an attacker can influence. Apps that let users supply Liquid templates or template fragments (CMS themes, email builders, low-code field templating) can be driven to execute arbitrary code on the server.",
+        pattern: /["']liquidjs["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:[0-9]\.\d+\.\d+|10\.(?:[01]?\d|2[0-5])\.\d+)["']/g,
+        languages: ["json"],
+        fix: "Upgrade liquidjs to 10.26.0+: npm install liquidjs@latest. Never render user-supplied Liquid templates without sandboxing; treat template source as untrusted input.",
+        fixCode: '// package.json\n"liquidjs": "^10.26.0"  // or latest',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.1"],
+    },
+    {
+        id: "VG1079",
+        name: "TinyMCE XSS Cluster — media/object & content injection (CVE-2026-47759/47760/47761/47762)",
+        severity: "high",
+        owasp: "A02:2025 Injection",
+        description: "TinyMCE before 5.11.1, 6.0.0 -> 7.9.2, and 8.0.0 -> 8.5.0 carries a cluster of stored/DOM XSS vulnerabilities (GHSA-vg35-5wq7-3x7w, GHSA-v98h-vmpc-fpqv, GHSA-q742-qvgc-gc2f, GHSA-mh5m-5hw4-5c69) including media-plugin `data-mce-object` injection. Any app embedding the TinyMCE editor and rendering its output can be driven to execute attacker-supplied script in another user's browser.",
+        pattern: /["']tinymce["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:[1-4]\.\d+\.\d+|5\.(?:[0-9]|10)\.\d+|5\.11\.0|6\.\d+\.\d+|7\.[0-8]\.\d+|7\.9\.[0-2]|8\.[0-4]\.\d+|8\.5\.0)["']/g,
+        languages: ["json"],
+        fix: "Upgrade tinymce to 7.9.3+ (v7) or 8.5.1+ (v8): npm install tinymce@latest. The 5.x line has no fix — migrate off it. Always sanitize TinyMCE output server-side before rendering it to other users.",
+        fixCode: '// package.json\n"tinymce": "^8.5.1"  // or "^7.9.3" for v7\n\n// Sanitize editor output before persisting/rendering\nimport DOMPurify from "isomorphic-dompurify";\n' + 'const clean = DOMPurify.sanitize(editorHtml);',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.7"],
+    },
 ];

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "guardvibe",
-  "version": "3.1.30",
+  "version": "3.1.32",
   "mcpName": "io.github.goklab/guardvibe",
-  "description": "Security MCP for vibe coding. 429 rules, 36 tools, CLI + doctor. Host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis. 63 CVE rules refreshed daily from GHSA/OSV/CISA KEV — Miasma @redhat-cloud-services compromise, Next.js May 2026 13-advisory cluster, Drizzle/MikroORM/Kysely SQL injection, Axios proxy-auth redirect leak, Hono setCookie attribute injection, Clerk SSRF, tRPC prototype pollution, @tanstack supply-chain, node-ipc protestware, OpenClaude sandbox bypass, plus the full AI-generated stack (Supabase, Stripe, Prisma, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK). 68 AI-native rules including OWASP MCP Top 10 tool-description prompt injection (VG1068), model-controlled sandbox-disable flag detection (VG1063), Session messenger exfil endpoint IOC (VG1075), and CI/CD supply-chain hardening (VG1070 npm --expect-provenance / --ignore-scripts enforcement).",
+  "description": "Security MCP for vibe coding. 433 rules, 36 tools, CLI + doctor. Host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis. 67 CVE rules refreshed daily from GHSA/OSV/CISA KEV — Miasma @redhat-cloud-services compromise, Next.js May 2026 13-advisory cluster, Drizzle/MikroORM/Kysely SQL injection, Axios proxy-auth redirect leak, Hono setCookie attribute injection, Clerk SSRF, tRPC prototype pollution, @tanstack supply-chain, node-ipc protestware, OpenClaude sandbox bypass, plus the full AI-generated stack (Supabase, Stripe, Prisma, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK). 68 AI-native rules including OWASP MCP Top 10 tool-description prompt injection (VG1068), model-controlled sandbox-disable flag detection (VG1063), Session messenger exfil endpoint IOC (VG1075), and CI/CD supply-chain hardening (VG1070 npm --expect-provenance / --ignore-scripts enforcement).",
   "type": "module",
   "bin": {
     "guardvibe": "build/cli.js",
@@ -34,7 +34,8 @@
     "lint": "eslint src/",
     "test": "node --import tsx --test tests/**/*.test.ts",
     "test:coverage": "c8 --reporter=lcov --reporter=text node --import tsx --test tests/**/*.test.ts",
-    "gate": "node scripts/release-gate.mjs"
+    "gate": "node scripts/release-gate.mjs",
+    "intel": "node scripts/intel-check.mjs"
   },
   "keywords": [
     "mcp",