THU-MAIC/OpenMAIC v1.0.3

OpenMAIC v1.0.3 — Security

on GitHub

A security release. Three advisories are published with this release, and Next.js is upgraded to patch a critical remote code execution. It also carries the fixes and features merged since 1.0.2.

Security

• Access-code tokens never expired, and verification was not throttled. Verification tokens (timestamp.HMAC) were accepted regardless of age because neither verifier checked the timestamp, and POST /api/access-code/verify had no attempt throttling. Both verifiers now enforce a 7-day server-side lifetime and reject non-canonical signatures, and verification is rate-limited per client when TRUST_PROXY_HEADERS=true; without a trusted proxy the app cannot attribute requests to a client, so a long random ACCESS_CODE is the protection and a warning is logged when it is short. GHSA-qpmr-534w-hhpg — reported by @CaptBoykin (#1513)
• The render service ran untrusted HTML in headless Chromium without a network policy. On the /preview and /render paths the packager's Content-Security-Policy was not applied, so inline script could reach loopback and internal addresses, and on /render the response was painted into the returned MP4. Both paths now inject a first-parsed CSP, the preview frame is additionally guarded by request interception, and framed same-origin .svg/.xhtml documents are sanitized. In the shipped image the container's egress lockdown already limited the reachable surface to loopback; deployments that disable it or run the service unisolated were exposed. GHSA-vqq3-22q7-289w — reported by @CaptBoykin (#1512)
• Audio provider requests followed redirects and re-resolved DNS unvalidated. TTS, ASR, voice registration and voice cloning validated a client-supplied base URL once and then issued a plain fetch, so a redirect or a DNS-rebinding answer could reach an internal address. These requests now validate every redirect hop and connect only to the addresses the guard validated, on every hop; a client base URL can never reach a private, loopback or cloud-metadata address, even with ALLOW_LOCAL_NETWORKS set. GHSA-9p8q-rcmg-pmjw — reported by @CaptBoykin (#1514)
• Next.js upgraded to patch a critical RCE. Bumped from 16.2.11 to 16.3.3, which patches an unauthenticated remote code execution on Windows-hosted servers (GHSA-p293-qw3h-jr36 / CVE-2026-75604). (#1503)

Features

• Storage: the server owns the asset entry lifecycle and releases assets on course deletion. (#1472, #1473)
• Skills: add an inquiry-based exercise-class teaching skill grounded in the zone of proximal development. (#1382)

Bug Fixes

• Importer: resolve embedded PPTX videos when the legacy link points at NULL, and upload video posters through the configured callback (@openmaic/importer 0.2.1). (#1507)
• Storage: keep jsonb writes valid when model output contains NUL or lone surrogates (#1499); allow one owner material to be bound to multiple sessions (#1500).
• Classroom: render a transient server error as a retryable state instead of the terminal "course does not exist" card, on both the pane and the standalone route. (#1485)
• Upload: resolve the generic Office MIME (application/vnd.ms-office) via the filename extension. (#1498)
• Settings: maintain the ASR language state invariant on provider selection. (#1443)
• TTS: treat a custom provider's Add-dialog default base URL as a configured credential path so generation narration is not skipped. (#1482)
• Export: tolerate malformed authored CSS in classroom exports instead of dropping later assets. (#1422)
• Render service: preserve plan audio during chunk assembly. (#1358)
• Docker: enable the Pro workbench flag in Docker builds and allow a non-TLS localhost cookie. (#1484)

Other Changes

• Docs: document the deployment assumptions and pre-report checks in the security policy. (#1511)
• Tests: isolate the image URL-guard test environment so it no longer inherits the generic OpenAI fallback. (#1476)

Full Changelog: https://github.com/THU-MAIC/OpenMAIC/blob/main/CHANGELOG.md