SolidCraft 0.30.1, released on 2 November at 17:21 UTC, is a patch release for the open-source Rust CAD app. Alongside a fix for a black screen in the browser version, it closes three security advisories that the project published a few minutes later. All three affect versions before 0.30.1 and are fixed in 0.30.1. None has a CVE, and the severities are the project’s own ratings.
Agent chat said yes on your behalf (medium)
SolidCraft’s agent chat can drive ACP coding agents. When an agent asked for permission, GHSA-5qmr-rrpg-gw8r says SolidCraft treated the request as one of its own tools if the free-text title contained the word solidcraft, and approved it without asking, “whatever permission mode the user chose (including "Ask every time")”.
The agent writes that title. Claude’s adapter is not affected because SolidCraft turns off Claude Code’s own shell and file tools. Other agents in the list keep their own shell and file tools, and their titles are often the command line or file path. The advisory notes the agent’s working folder on Linux is ~/.local/share/solidcraft/agent-chat/work, so many ordinary file titles already matched. Its example is a prompt injection in design content that gets an agent to run a command mentioning the SolidCraft CLI. This is the pattern we described in prompt injection reaches agents through the data they read.
In 0.30.1 agent chat answers on its own only when the whole title is an exact tool name of its own server, such as mcp__solidcraft-app__batch, and the request kind is other or not given. Everything else goes through your permission mode.
The release notes list what this changes:
- Claude adapter users see no change.
- Goose users get questions they did not get before. OpenCode users probably do too.
- A SolidCraft MCP server you added yourself under the name
solidcraftnow asks. - Always allow and Allow everything still work.
The project says the title formats come from reading the adapters’ source, not from running them against live agents, and that Copilot, Grok and Antigravity were not checked.
A planted symlink could overwrite a file (high)
SolidCraft writes a lock file, .~<name>.lock, beside each open design. GHSA-j4hx-qmq3-7mr4 says the writer followed symbolic links. A design folder from a git repository, zip or synced folder could hold a symlink at that path, and opening the design replaced the target with lock JSON. The advisory names ~/.bashrc and ~/.ssh/authorized_keys as examples and says it is data loss and denial of service, not code execution. A lock linked to a device could crash or hang the app. 0.30.1 refuses anything at the lock path that is not a regular file.
An API key could leave over plain HTTP (low)
SolidCraft only sends an API key over HTTPS or over HTTP to this computer. GHSA-x92v-h8x5-5698 shows the check read http://evil.example#@localhost/v1 as localhost while the HTTP client sent the request to evil.example. It needs the user to paste the crafted URL. Plain HTTP now needs a host of exactly localhost, 127.0.0.1 or [::1].
Caveats
The reporter says each issue was found by reading the code and not run end to end. The advisories are filed under the ecosystem other. GitHub’s global advisory API returned 404 for all three on 3 November, so Dependabot and other tools that read that database will not flag them. Check your version yourself.
Why this matters
SolidCraft has been leaning into agent integration since 0.22.1 started adding itself to AI clients’ MCP config, and this release shows where that gets sharp: a permission shortcut keyed on agent-written text. If you use agent chat with Goose, OpenCode or another non-Claude agent, upgrade to 0.30.1 and expect more prompts. With no Dependabot alert coming, the upgrade is on you.
The Campfire
CommentsThanks. Your comment is waiting for the desk. Once it is approved it appears here within about a minute.
Add a comment