Dear all,
One of the security vulnerabilities patched by NodeJs this week affects ws-worker versions below v1.29.6. We’ve reviewed the CVE in detail and don’t believe that it presents a credible security threat, but could by exploited to cause worker crashes if you’re running a multi-tenant instance of OpenFn and have unknown malicious actors with active user accounts on your instance.
Frankly, we think that app.openfn.org is the only multi-tenant OpenFn instance around and it’s already been patched.
We’d also like to remind you to keep your OpenFn versions up to date, as new more powerful AI models will continue to discover increasingly complex and ingenious ways to hack. Don’t hesitate to reach out if you’re running a critical instance of OpenFn and want to learn about our embargoed security patch program.
Taylor