From a5f11e12a0a7351397902a7d932ea98948faf62e Mon Sep 17 00:00:00 2001 From: Christopher Langton Date: Sat, 14 Nov 2026 00:56:33 +1100 Subject: [PATCH] fix(GCVE-110-NPM-2026-034409): familiar-vtt fixed in 2.22.0 The update-macro handler in the Foundry module refuses command updates on script macros from 2.22.0 (familiar.zip release asset); 2.21.0 only refused a type change. Affected range is now introduced 2.5.16, fixed 2.22.0, across the Vulnetix, OSV and CVE 5 formats. --- .../2026/34xxx/GCVE-110-NPM-2026-034409.json | 29 +++++++++++++++---- index/manifest.json | 2 +- .../2026/34xxx/GCVE-110-NPM-2026-034409.json | 14 +++++++-- .../2026/34xxx/GCVE-110-NPM-2026-034409.json | 27 ++++++++++++++--- 4 files changed, 59 insertions(+), 13 deletions(-) diff --git a/cvelistv5/NPM/2026/34xxx/GCVE-110-NPM-2026-034409.json b/cvelistv5/NPM/2026/34xxx/GCVE-110-NPM-2026-034409.json index 45b318476c..fbc8614d5f 100644 --- a/cvelistv5/NPM/2026/34xxx/GCVE-110-NPM-2026-034409.json +++ b/cvelistv5/NPM/2026/34xxx/GCVE-110-NPM-2026-034409.json @@ -4,7 +4,7 @@ "affected": [ { "collectionURL": "https://www.npmjs.com", - "defaultStatus": "unknown", + "defaultStatus": "unaffected", "modules": [ "dist/mcp-package/index.mjs" ], @@ -27,10 +27,15 @@ "vendor": "npm", "versions": [ { - "lessThanOrEqual": "2.26.0", + "lessThan": "2.22.0", "status": "affected", "version": "2.5.16", "versionType": "semver" + }, + { + "status": "unaffected", + "version": "2.22.0", + "versionType": "semver" } ] } @@ -38,7 +43,7 @@ "descriptions": [ { "lang": "en", - "value": "familiar-vtt is an MCP server that lets an AI assistant operate a Foundry VTT world through tools. Its create-macro tool refuses script macros because they \"run arbitrary JavaScript with full Foundry API access\" (from 2.11.0; in 2.5.16 to 2.10.0 it accepts them, gated only by prompt text). The update-macro tool, annotated non-destructive (destructiveHint false), forwards a new command for any existing macro, and by its own description \"existing GM-authored script macros keep their type and remain executable\". The new code runs when execute-macro is called or when the GM runs the macro in Foundry. Content the assistant reads through its read tools, such as player chat, journal entries and actor data, can therefore steer it into replacing a GM's script macro with arbitrary JavaScript that later runs with the GM's Foundry permissions, bypassing the restriction create-macro enforces. Affects 2.5.16 through 2.26.0." + "value": "familiar-vtt is an MCP server that lets an AI assistant operate a Foundry VTT world through tools. Its create-macro tool refuses script macros because they \"run arbitrary JavaScript with full Foundry API access\" (from 2.11.0; in 2.5.16 to 2.10.0 it accepts them, gated only by prompt text). The update-macro tool, annotated non-destructive (destructiveHint false), forwards a new command for any existing macro, and by its own description \"existing GM-authored script macros keep their type and remain executable\". The new code runs when execute-macro is called or when the GM runs the macro in Foundry. Content the assistant reads through its read tools, such as player chat, journal entries and actor data, can therefore steer it into replacing a GM's script macro with arbitrary JavaScript that later runs with the GM's Foundry permissions, bypassing the restriction create-macro enforces. Affects 2.5.16 up to, but not including, 2.22.0. From 2.22.0 the update-macro handler in the Foundry module (familiar.zip, which runs the tools the npm MCP server forwards) refuses any command update on a script macro before the write, for the MCP and the built-in chat routes alike, and update-compendium-entry refuses the same for script macros in compendium packs. The update-macro tool description in 2.22.0 through 2.26.0 still says script macros \\\"remain executable\\\", but the handler refuses the edit." } ], "metrics": [ @@ -74,7 +79,7 @@ } ], "providerMetadata": { - "dateUpdated": "2026-10-24T22:38:38Z", + "dateUpdated": "2026-11-13T13:55:59Z", "orgId": "4c0d58bb-5895-4ca8-94cf-1885b1c0f000", "shortName": "Vulnetix" }, @@ -97,6 +102,20 @@ "issue-tracking" ], "url": "https://github.com/Vulnetix/advisory-database/issues/8" + }, + { + "name": "familiar-vtt v2.22.0 release (Foundry module familiar.zip)", + "tags": [ + "release-notes" + ], + "url": "https://github.com/Ryanjansen92/familiar-releases/releases/tag/v2.22.0" + }, + { + "name": "familiar-vtt 2.22.0", + "tags": [ + "release-notes" + ], + "url": "https://www.npmjs.com/package/familiar-vtt/v/2.22.0" } ], "tags": [ @@ -111,7 +130,7 @@ "assignerShortName": "Vulnetix", "cveId": "GCVE-110-NPM-2026-034409", "datePublished": "2026-10-05T23:41:20Z", - "dateUpdated": "2026-10-24T22:38:38Z", + "dateUpdated": "2026-11-13T13:55:59Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", diff --git a/index/manifest.json b/index/manifest.json index e9c57356d1..bb5bf9f42a 100644 --- a/index/manifest.json +++ b/index/manifest.json @@ -545612,7 +545612,7 @@ "family": "NPM", "classification": "vulnerability", "state": "published", - "modified": "2026-10-24T22:38:38Z", + "modified": "2026-11-13T13:55:59Z", "schema_version": "1.2.0", "enriched": "full", "sections": [ diff --git a/osv/NPM/2026/34xxx/GCVE-110-NPM-2026-034409.json b/osv/NPM/2026/34xxx/GCVE-110-NPM-2026-034409.json index f9fa069fa1..15431db805 100644 --- a/osv/NPM/2026/34xxx/GCVE-110-NPM-2026-034409.json +++ b/osv/NPM/2026/34xxx/GCVE-110-NPM-2026-034409.json @@ -25,7 +25,7 @@ "introduced": "2.5.16" }, { - "last_affected": "2.26.0" + "fixed": "2.22.0" } ], "type": "ECOSYSTEM" @@ -45,9 +45,9 @@ "source": "npm" } }, - "details": "familiar-vtt is an MCP server that lets an AI assistant operate a Foundry VTT world through tools. Its create-macro tool refuses script macros because they \"run arbitrary JavaScript with full Foundry API access\" (from 2.11.0; in 2.5.16 to 2.10.0 it accepts them, gated only by prompt text). The update-macro tool, annotated non-destructive (destructiveHint false), forwards a new command for any existing macro, and by its own description \"existing GM-authored script macros keep their type and remain executable\". The new code runs when execute-macro is called or when the GM runs the macro in Foundry. Content the assistant reads through its read tools, such as player chat, journal entries and actor data, can therefore steer it into replacing a GM's script macro with arbitrary JavaScript that later runs with the GM's Foundry permissions, bypassing the restriction create-macro enforces. Affects 2.5.16 through 2.26.0.", + "details": "familiar-vtt is an MCP server that lets an AI assistant operate a Foundry VTT world through tools. Its create-macro tool refuses script macros because they \"run arbitrary JavaScript with full Foundry API access\" (from 2.11.0; in 2.5.16 to 2.10.0 it accepts them, gated only by prompt text). The update-macro tool, annotated non-destructive (destructiveHint false), forwards a new command for any existing macro, and by its own description \"existing GM-authored script macros keep their type and remain executable\". The new code runs when execute-macro is called or when the GM runs the macro in Foundry. Content the assistant reads through its read tools, such as player chat, journal entries and actor data, can therefore steer it into replacing a GM's script macro with arbitrary JavaScript that later runs with the GM's Foundry permissions, bypassing the restriction create-macro enforces. Affects 2.5.16 up to, but not including, 2.22.0. From 2.22.0 the update-macro handler in the Foundry module (familiar.zip, which runs the tools the npm MCP server forwards) refuses any command update on a script macro before the write, for the MCP and the built-in chat routes alike, and update-compendium-entry refuses the same for script macros in compendium packs. The update-macro tool description in 2.22.0 through 2.26.0 still says script macros \\\"remain executable\\\", but the handler refuses the edit.", "id": "GCVE-110-NPM-2026-034409", - "modified": "2026-10-24T22:38:38Z", + "modified": "2026-11-13T13:55:59Z", "published": "2026-10-05T23:41:20Z", "references": [ { @@ -65,6 +65,14 @@ { "type": "DISCUSSION", "url": "https://github.com/Vulnetix/advisory-database/issues/8" + }, + { + "type": "WEB", + "url": "https://github.com/Ryanjansen92/familiar-releases/releases/tag/v2.22.0" + }, + { + "type": "WEB", + "url": "https://www.npmjs.com/package/familiar-vtt/v/2.22.0" } ], "schema_version": "1.6.0", diff --git a/vulnetix/NPM/2026/34xxx/GCVE-110-NPM-2026-034409.json b/vulnetix/NPM/2026/34xxx/GCVE-110-NPM-2026-034409.json index 3f90f70bc8..0449cee481 100644 --- a/vulnetix/NPM/2026/34xxx/GCVE-110-NPM-2026-034409.json +++ b/vulnetix/NPM/2026/34xxx/GCVE-110-NPM-2026-034409.json @@ -21,7 +21,7 @@ ] }, "collection_url": "https://www.npmjs.com", - "default_status": "unknown", + "default_status": "unaffected", "ecosystem": "npm", "name": "familiar-vtt", "product": "familiar-vtt", @@ -29,16 +29,21 @@ "vendor": "npm", "versions": [ { - "less_than_or_equal": "2.26.0", + "less_than": "2.22.0", "status": "affected", "version": "2.5.16", "version_type": "semver" + }, + { + "status": "unaffected", + "version": "2.22.0", + "version_type": "semver" } ] } ], "classification": "vulnerability", - "details": "familiar-vtt is an MCP server that lets an AI assistant operate a Foundry VTT world through tools. Its create-macro tool refuses script macros because they \"run arbitrary JavaScript with full Foundry API access\" (from 2.11.0; in 2.5.16 to 2.10.0 it accepts them, gated only by prompt text). The update-macro tool, annotated non-destructive (destructiveHint false), forwards a new command for any existing macro, and by its own description \"existing GM-authored script macros keep their type and remain executable\". The new code runs when execute-macro is called or when the GM runs the macro in Foundry. Content the assistant reads through its read tools, such as player chat, journal entries and actor data, can therefore steer it into replacing a GM's script macro with arbitrary JavaScript that later runs with the GM's Foundry permissions, bypassing the restriction create-macro enforces. Affects 2.5.16 through 2.26.0.", + "details": "familiar-vtt is an MCP server that lets an AI assistant operate a Foundry VTT world through tools. Its create-macro tool refuses script macros because they \"run arbitrary JavaScript with full Foundry API access\" (from 2.11.0; in 2.5.16 to 2.10.0 it accepts them, gated only by prompt text). The update-macro tool, annotated non-destructive (destructiveHint false), forwards a new command for any existing macro, and by its own description \"existing GM-authored script macros keep their type and remain executable\". The new code runs when execute-macro is called or when the GM runs the macro in Foundry. Content the assistant reads through its read tools, such as player chat, journal entries and actor data, can therefore steer it into replacing a GM's script macro with arbitrary JavaScript that later runs with the GM's Foundry permissions, bypassing the restriction create-macro enforces. Affects 2.5.16 up to, but not including, 2.22.0. From 2.22.0 the update-macro handler in the Foundry module (familiar.zip, which runs the tools the npm MCP server forwards) refuses any command update on a script macro before the write, for the MCP and the built-in chat routes alike, and update-compendium-entry refuses the same for script macros in compendium packs. The update-macro tool description in 2.22.0 through 2.26.0 still says script macros \\\"remain executable\\\", but the handler refuses the edit.", "detection": { "tree_sitter": [ { @@ -184,7 +189,7 @@ "year": 2026 }, "id": "GCVE-110-NPM-2026-034409", - "modified": "2026-10-24T22:38:38Z", + "modified": "2026-11-13T13:55:59Z", "published": "2026-10-05T23:41:20Z", "references": [ { @@ -206,6 +211,20 @@ "x_disputed" ], "url": "https://github.com/Vulnetix/advisory-database/issues/8" + }, + { + "name": "familiar-vtt v2.22.0 release (Foundry module familiar.zip)", + "tags": [ + "release-notes" + ], + "url": "https://github.com/Ryanjansen92/familiar-releases/releases/tag/v2.22.0" + }, + { + "name": "familiar-vtt 2.22.0", + "tags": [ + "release-notes" + ], + "url": "https://www.npmjs.com/package/familiar-vtt/v/2.22.0" } ], "review": {