fix(GCVE-110-NPM-2026-034409): familiar-vtt fixed in 2.22.0

cvelistv5/NPM/2026/34xxx/GCVE-110-NPM-2026-034409.json

@@ -4,7 +4,7 @@
       "affected": [
         {
           "collectionURL": "https://www.npmjs.com",
-          "defaultStatus": "unknown",
+          "defaultStatus": "unaffected",
           "modules": [
             "dist/mcp-package/index.mjs"
           ],
@@ -27,18 +27,23 @@
           "vendor": "npm",
           "versions": [
             {
-              "lessThanOrEqual": "2.26.0",
+              "lessThan": "2.22.0",
               "status": "affected",
               "version": "2.5.16",
               "versionType": "semver"
+            },
+            {
+              "status": "unaffected",
+              "version": "2.22.0",
+              "versionType": "semver"
             }
           ]
         }
       ],
       "descriptions": [
         {
           "lang": "en",
-          "value": "familiar-vtt is an MCP server that lets an AI assistant operate a Foundry VTT world through tools. Its create-macro tool refuses script macros because they \"run arbitrary JavaScript with full Foundry API access\" (from 2.11.0; in 2.5.16 to 2.10.0 it accepts them, gated only by prompt text). The update-macro tool, annotated non-destructive (destructiveHint false), forwards a new command for any existing macro, and by its own description \"existing GM-authored script macros keep their type and remain executable\". The new code runs when execute-macro is called or when the GM runs the macro in Foundry. Content the assistant reads through its read tools, such as player chat, journal entries and actor data, can therefore steer it into replacing a GM's script macro with arbitrary JavaScript that later runs with the GM's Foundry permissions, bypassing the restriction create-macro enforces. Affects 2.5.16 through 2.26.0."
+          "value": "familiar-vtt is an MCP server that lets an AI assistant operate a Foundry VTT world through tools. Its create-macro tool refuses script macros because they \"run arbitrary JavaScript with full Foundry API access\" (from 2.11.0; in 2.5.16 to 2.10.0 it accepts them, gated only by prompt text). The update-macro tool, annotated non-destructive (destructiveHint false), forwards a new command for any existing macro, and by its own description \"existing GM-authored script macros keep their type and remain executable\". The new code runs when execute-macro is called or when the GM runs the macro in Foundry. Content the assistant reads through its read tools, such as player chat, journal entries and actor data, can therefore steer it into replacing a GM's script macro with arbitrary JavaScript that later runs with the GM's Foundry permissions, bypassing the restriction create-macro enforces. Affects 2.5.16 up to, but not including, 2.22.0. From 2.22.0 the update-macro handler in the Foundry module (familiar.zip, which runs the tools the npm MCP server forwards) refuses any command update on a script macro before the write, for the MCP and the built-in chat routes alike, and update-compendium-entry refuses the same for script macros in compendium packs. The update-macro tool description in 2.22.0 through 2.26.0 still says script macros \\\"remain executable\\\", but the handler refuses the edit."
         }
       ],
       "metrics": [
@@ -74,7 +79,7 @@
         }
       ],
       "providerMetadata": {
-        "dateUpdated": "2026-10-24T22:38:38Z",
+        "dateUpdated": "2026-11-13T13:55:59Z",
         "orgId": "4c0d58bb-5895-4ca8-94cf-1885b1c0f000",
         "shortName": "Vulnetix"
       },
@@ -97,6 +102,20 @@
             "issue-tracking"
           ],
           "url": "https://github.com/Vulnetix/advisory-database/issues/8"
+        },
+        {
+          "name": "familiar-vtt v2.22.0 release (Foundry module familiar.zip)",
+          "tags": [
+            "release-notes"
+          ],
+          "url": "https://github.com/Ryanjansen92/familiar-releases/releases/tag/v2.22.0"
+        },
+        {
+          "name": "familiar-vtt 2.22.0",
+          "tags": [
+            "release-notes"
+          ],
+          "url": "https://www.npmjs.com/package/familiar-vtt/v/2.22.0"
         }
       ],
       "tags": [
@@ -111,7 +130,7 @@
     "assignerShortName": "Vulnetix",
     "cveId": "GCVE-110-NPM-2026-034409",
     "datePublished": "2026-10-05T23:41:20Z",
-    "dateUpdated": "2026-10-24T22:38:38Z",
+    "dateUpdated": "2026-11-13T13:55:59Z",
     "state": "PUBLISHED"
   },
   "dataType": "CVE_RECORD",

index/manifest.json

@@ -545612,7 +545612,7 @@
       "family": "NPM",
       "classification": "vulnerability",
       "state": "published",
-      "modified": "2026-10-24T22:38:38Z",
+      "modified": "2026-11-13T13:55:59Z",
       "schema_version": "1.2.0",
       "enriched": "full",
       "sections": [

osv/NPM/2026/34xxx/GCVE-110-NPM-2026-034409.json

@@ -25,7 +25,7 @@
               "introduced": "2.5.16"
             },
             {
-              "last_affected": "2.26.0"
+              "fixed": "2.22.0"
             }
           ],
           "type": "ECOSYSTEM"
@@ -45,9 +45,9 @@
       "source": "npm"
     }
   },
-  "details": "familiar-vtt is an MCP server that lets an AI assistant operate a Foundry VTT world through tools. Its create-macro tool refuses script macros because they \"run arbitrary JavaScript with full Foundry API access\" (from 2.11.0; in 2.5.16 to 2.10.0 it accepts them, gated only by prompt text). The update-macro tool, annotated non-destructive (destructiveHint false), forwards a new command for any existing macro, and by its own description \"existing GM-authored script macros keep their type and remain executable\". The new code runs when execute-macro is called or when the GM runs the macro in Foundry. Content the assistant reads through its read tools, such as player chat, journal entries and actor data, can therefore steer it into replacing a GM's script macro with arbitrary JavaScript that later runs with the GM's Foundry permissions, bypassing the restriction create-macro enforces. Affects 2.5.16 through 2.26.0.",
+  "details": "familiar-vtt is an MCP server that lets an AI assistant operate a Foundry VTT world through tools. Its create-macro tool refuses script macros because they \"run arbitrary JavaScript with full Foundry API access\" (from 2.11.0; in 2.5.16 to 2.10.0 it accepts them, gated only by prompt text). The update-macro tool, annotated non-destructive (destructiveHint false), forwards a new command for any existing macro, and by its own description \"existing GM-authored script macros keep their type and remain executable\". The new code runs when execute-macro is called or when the GM runs the macro in Foundry. Content the assistant reads through its read tools, such as player chat, journal entries and actor data, can therefore steer it into replacing a GM's script macro with arbitrary JavaScript that later runs with the GM's Foundry permissions, bypassing the restriction create-macro enforces. Affects 2.5.16 up to, but not including, 2.22.0. From 2.22.0 the update-macro handler in the Foundry module (familiar.zip, which runs the tools the npm MCP server forwards) refuses any command update on a script macro before the write, for the MCP and the built-in chat routes alike, and update-compendium-entry refuses the same for script macros in compendium packs. The update-macro tool description in 2.22.0 through 2.26.0 still says script macros \\\"remain executable\\\", but the handler refuses the edit.",
   "id": "GCVE-110-NPM-2026-034409",
-  "modified": "2026-10-24T22:38:38Z",
+  "modified": "2026-11-13T13:55:59Z",
   "published": "2026-10-05T23:41:20Z",
   "references": [
     {
@@ -65,6 +65,14 @@
     {
       "type": "DISCUSSION",
       "url": "https://github.com/Vulnetix/advisory-database/issues/8"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Ryanjansen92/familiar-releases/releases/tag/v2.22.0"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.npmjs.com/package/familiar-vtt/v/2.22.0"
     }
   ],
   "schema_version": "1.6.0",

vulnetix/NPM/2026/34xxx/GCVE-110-NPM-2026-034409.json

@@ -21,24 +21,29 @@
         ]
       },
       "collection_url": "https://www.npmjs.com",
-      "default_status": "unknown",
+      "default_status": "unaffected",
       "ecosystem": "npm",
       "name": "familiar-vtt",
       "product": "familiar-vtt",
       "purl": "pkg:npm/familiar-vtt",
       "vendor": "npm",
       "versions": [
         {
-          "less_than_or_equal": "2.26.0",
+          "less_than": "2.22.0",
           "status": "affected",
           "version": "2.5.16",
           "version_type": "semver"
+        },
+        {
+          "status": "unaffected",
+          "version": "2.22.0",
+          "version_type": "semver"
         }
       ]
     }
   ],
   "classification": "vulnerability",
-  "details": "familiar-vtt is an MCP server that lets an AI assistant operate a Foundry VTT world through tools. Its create-macro tool refuses script macros because they \"run arbitrary JavaScript with full Foundry API access\" (from 2.11.0; in 2.5.16 to 2.10.0 it accepts them, gated only by prompt text). The update-macro tool, annotated non-destructive (destructiveHint false), forwards a new command for any existing macro, and by its own description \"existing GM-authored script macros keep their type and remain executable\". The new code runs when execute-macro is called or when the GM runs the macro in Foundry. Content the assistant reads through its read tools, such as player chat, journal entries and actor data, can therefore steer it into replacing a GM's script macro with arbitrary JavaScript that later runs with the GM's Foundry permissions, bypassing the restriction create-macro enforces. Affects 2.5.16 through 2.26.0.",
+  "details": "familiar-vtt is an MCP server that lets an AI assistant operate a Foundry VTT world through tools. Its create-macro tool refuses script macros because they \"run arbitrary JavaScript with full Foundry API access\" (from 2.11.0; in 2.5.16 to 2.10.0 it accepts them, gated only by prompt text). The update-macro tool, annotated non-destructive (destructiveHint false), forwards a new command for any existing macro, and by its own description \"existing GM-authored script macros keep their type and remain executable\". The new code runs when execute-macro is called or when the GM runs the macro in Foundry. Content the assistant reads through its read tools, such as player chat, journal entries and actor data, can therefore steer it into replacing a GM's script macro with arbitrary JavaScript that later runs with the GM's Foundry permissions, bypassing the restriction create-macro enforces. Affects 2.5.16 up to, but not including, 2.22.0. From 2.22.0 the update-macro handler in the Foundry module (familiar.zip, which runs the tools the npm MCP server forwards) refuses any command update on a script macro before the write, for the MCP and the built-in chat routes alike, and update-compendium-entry refuses the same for script macros in compendium packs. The update-macro tool description in 2.22.0 through 2.26.0 still says script macros \\\"remain executable\\\", but the handler refuses the edit.",
   "detection": {
     "tree_sitter": [
       {
@@ -184,7 +189,7 @@
     "year": 2026
   },
   "id": "GCVE-110-NPM-2026-034409",
-  "modified": "2026-10-24T22:38:38Z",
+  "modified": "2026-11-13T13:55:59Z",
   "published": "2026-10-05T23:41:20Z",
   "references": [
     {
@@ -206,6 +211,20 @@
         "x_disputed"
       ],
       "url": "https://github.com/Vulnetix/advisory-database/issues/8"
+    },
+    {
+      "name": "familiar-vtt v2.22.0 release (Foundry module familiar.zip)",
+      "tags": [
+        "release-notes"
+      ],
+      "url": "https://github.com/Ryanjansen92/familiar-releases/releases/tag/v2.22.0"
+    },
+    {
+      "name": "familiar-vtt 2.22.0",
+      "tags": [
+        "release-notes"
+      ],
+      "url": "https://www.npmjs.com/package/familiar-vtt/v/2.22.0"
     }
   ],
   "review": {