kritya 0.8.6-beta → 0.8.8-beta

package/dist/tools/document/xlsx.js

@@ -1,6 +1,30 @@
 import ExcelJS from "exceljs";
+import JSZip from "jszip";
 const CELL_REF_RE = /^[A-Za-z]{1,3}[1-9][0-9]*$/;
+// exceljs's xlsx loader decompresses every entry of the .xlsx zip with no
+// size limit (CVE-2026-78206, unpatched upstream as of this writing) — a
+// small file whose declared uncompressed size is huge can exhaust memory
+// before exceljs itself ever runs. JSZip.loadAsync only reads the central
+// directory (cheap, no inflation), so summing each entry's *declared*
+// uncompressed size here rejects a bomb before handing the buffer to exceljs.
+const MAX_XLSX_UNCOMPRESSED_BYTES = 200 * 1024 * 1024;
+async function assertSafeXlsxSize(buf) {
+    const zip = await JSZip.loadAsync(buf);
+    let total = 0;
+    for (const entry of Object.values(zip.files)) {
+        // `_data` is JSZip's internal CompressedObject; there is no public API
+        // for a zip entry's declared (pre-inflation) uncompressed size.
+        total +=
+            entry._data?.uncompressedSize ?? 0;
+        if (total > MAX_XLSX_UNCOMPRESSED_BYTES) {
+            throw new Error(`This .xlsx file's declared uncompressed size exceeds ` +
+                `${MAX_XLSX_UNCOMPRESSED_BYTES / (1024 * 1024)}MB and was refused ` +
+                `as a likely decompression bomb rather than risk exhausting memory.`);
+        }
+    }
+}
 export async function readXlsx(buf) {
+    await assertSafeXlsxSize(buf);
     const workbook = new ExcelJS.Workbook();
     // exceljs's bundled types pin an older @types/node Buffer shape; the
     // runtime accepts any Node Buffer.
@@ -43,12 +67,18 @@ function toCellValue(value) {
     }
     return value;
 }
+// If CSV export via exceljs's `workbook.csv.write()`/`writeBuffer()`/
+// `writeFile()` is ever added, string values starting with =, +, -, @, tab,
+// or CR must be prefixed with a leading `'` before export (CVE-2026-78209) —
+// exceljs does not do this itself, and cell content here can come from
+// LLM-generated or user-supplied text, not just trusted input.
 /**
  * Change specific cells of an existing workbook in place, preserving every
  * other cell, formula, and sheet. Returns the new file bytes and a record of
  * what changed (old -> new) for the permission preview and result message.
  */
 export async function editXlsx(buf, edits) {
+    await assertSafeXlsxSize(buf);
     const workbook = new ExcelJS.Workbook();
     await workbook.xlsx.load(buf);
     const applied = [];
@@ -74,6 +104,12 @@ export async function editXlsx(buf, edits) {
     const arrayBuffer = await workbook.xlsx.writeBuffer();
     return { buf: Buffer.from(arrayBuffer), applied };
 }
+// If image embedding is ever added here via exceljs's `Workbook.addImage()`,
+// never pass a model/user-supplied path straight into `addImage({filename})`
+// — resolve it first and verify it stays inside the workspace, the same way
+// `resolveSafe` guards file-write paths elsewhere. An unchecked filename lets
+// addImage() read and embed an arbitrary file the process can see
+// (CVE-2026-78208).
 export async function writeXlsx(sheets) {
     const workbook = new ExcelJS.Workbook();
     for (const sheet of sheets) {

package/package.json

@@ -1,8 +1,17 @@
 {
   "name": "kritya",
-  "version": "0.8.6-beta",
+  "version": "0.8.8-beta",
   "description": "Kritya — a lean, provider-agnostic terminal coding agent (NVIDIA, OpenAI, OpenRouter, Groq, Ollama, and more)",
   "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/GenAICloudDevOps/Kritya.git"
+  },
+  "homepage": "https://github.com/GenAICloudDevOps/Kritya#readme",
+  "bugs": {
+    "url": "https://github.com/GenAICloudDevOps/Kritya/issues"
+  },
+  "author": "Venkata Ramanand",
   "bin": {
     "kritya": "dist/index.js"
   },
@@ -45,12 +54,12 @@
   "dependencies": {
     "docx": "^9.7.1",
     "exceljs": "^4.4.0",
-    "fast-glob": "^3.3.2",
+    "fast-glob": "^3.3.3",
     "ink": "^7.1.1",
     "ink-text-input": "^6.0.0",
     "jszip": "^3.10.1",
-    "mammoth": "^1.12.0",
-    "openai": "^7.4.0",
+    "mammoth": "^1.12.1",
+    "openai": "^7.5.0",
     "pdf-lib": "^1.17.1",
     "pdfjs-dist": "^6.1.200",
     "pptxgenjs": "^4.0.1",