GHSA-hqmx-mx83-h2xc: 
Rust vulnerability analysis and mitigation

Found in an internal audit on 2026-10-21. Fixed in 0.2.0-preview.5; upgrade to it.

What was found (up to 0.2.0-preview.4)

files::openable (crates/kule-daemon/src/files.rs) checks only the extension and magic bytes before "Open with its app". For docx/xlsx/pptx/odt/epub/pages/key the magic is the zip header. Nothing inspects relationships with TargetMode="External" (remote attachedTemplate, linked images, xl/externalLinks, connections.xml), vbaProject.bin, activeX/ or embeddings/. Files written by the agent carry no com.apple.quarantine, so Office opens them without Protected View and fetches an agent-chosen URL outside Kule's proxy and policy (a remote .dotm can bring macros). Code path confirmed; not run in Office. The OPENABLE comment says it never opens "a link to elsewhere". Found during the fix: the opened path was the agent's own file. An extended attribute the agent set on it, such as com.apple.LaunchServices.OpenWith, which names the app a file opens with, was honoured.

Fix

Fixed in 0.2.0-preview.5.

• Open with its app (app and kule open) opens Kule's own copy under <kule home>/opened/<new dir>/<name>:
  • The copy is cloned from the descriptor Kule opened and is checked after the copy is made, so nothing the agent does afterwards is what opens.
  • It is 0600 in a 0700 folder Kule owns.
  • It carries none of the file's extended attributes, only com.apple.quarantine on macOS.
  • Copies are removed after a day.
• kule_view::opens::opens_nothing_else looks inside the OOXML, ODF and CSV kinds before they open.
  • OOXML: it refuses a file with:
    • parts for macros, ActiveX, embeddings, external links, query tables, data models, customUI or connections;
    • binary parts other than printer settings;
    • macro, OLE or external-link content types;
    • relationships of those kinds, a template, a frame, a subdocument, altChunk or mail-merge source;
    • any external relationship other than a hyperlink to http(s) or mailto;
    • Word fields outside an allow-list, so DDE, INCLUDE*, LINK and MACROBUTTON are refused;
    • formulas with IMAGE, WEBSERVICE, RTD, CALL, REGISTER, EXEC, DDE or STOCKHISTORY, a DDE |, or an external workbook reference;
    • duplicate part names.
  • ODF: it refuses Basic, Scripts, embedded objects, DDE and linked sections or tables, event listeners, and hrefs outside the file other than hyperlinks.
  • CSV: it refuses cells that read as formulas.
  • A file that cannot be read is refused.
• pages, numbers, key, epub and rtf are no longer opened with their app.

Tests (seen failing first)

• documents_that_would_reach_outside_themselves_are_not_opened: a docx with an external attachedTemplate in word/_rels/settings.xml.rels and a docx with vbaProject.bin both return Err; so do an xlsx with external links or IMAGE, a CSV formula, and RTF, EPUB and Keynote files.
• what_opens_is_kules_own_copy_and_never_the_agents_file: the returned path is outside the copy, 0600, and on macOS carries only the quarantine mark, even when the agent set LaunchServices.OpenWith. Swapping the agent's file for a link afterwards changes nothing.
• copies_opened_long_ago_are_cleared, open_lets_through_documents_that_are_what_their_name_says.
• kule-view opens::tests::* (templates, pictures, macros, fields, formulas, ODF, CSV, unreadable files).
• 17 of 17 mutations caught.

Workaround

Upgrade to 0.2.0-preview.5. On an older version, open documents an agent wrote in the Preview only, or move them out and inspect them before opening with Office.