Security fix for authenticated SSRF vulnerability
This release addresses an authenticated SSRF vulnerability in Meilisearch. Self-hosting users who allow third parties to configure instances should upgrade, though no exploitation has been detected on Meilisearch Cloud.
Meilisearch v1.43.1 contains a security fix for an authenticated SSRF vulnerability.
No exploitation was found on Meilisearch Cloud. Cloud users are not required to update.
We recommend that self-hosting users upgrade if they allow third parties to configure Meilisearch instances.
We thank Sion Park (@tldhs1144), who reported the issue and suggested a fix, for improving the security of Meilisearch ❤️
Source: original entry ↗
More from Meilisearch
Follow Meilisearch to get its new changes in your feed and email digest.
v1.55.0: Dynamic search rule preview and facet performance details
Added support for inline dynamic search rules that preview rule effects on individual queries, and enhanced performance details to show facet distribution computation timing. The inlineRule parameter allows applying temporary rule overrides during search without persisting them, useful for preview UIs.
Avoid panic in highlighting with safer indexing
Replaced unsafe bracket indexing with get method and added None recovery in the highlighting logic to prevent panics. This improves stability when processing edge cases in search result highlighting.
Support edge case with 4G+ rules in DSR index
Added support for an edge case where the DSR index contains four or more rules, improving stability for complex rule configurations.