RTIR: RT for Incident Response

RTIR 5.0.11 Release Notes

RTIR 5.0.11 -- 2026-10-29
=========================

RTIR 5.0.11 is now available for general use. The list of changes
included with this release is below. In addition to the new features
and bug fixes listed below, this release contains a security fix. When
upgrading RTIR, you should also upgrade RT to version 5.0.11 for
compatibility with this release and to get the security fixes and
other improvements in RT 5.0.11.

https://download.bestpractical.com/pub/rt/release/RT-IR-5.0.11.tar.gz
https://download.bestpractical.com/pub/rt/release/RT-IR-5.0.11.tar.gz.asc

SHA-256 sums

d64337da73a11a90c865f50613de3601db1088b6c6e251825dd3b806b3f339c8  RT-IR-5.0.11.tar.gz
f8dfc8e77819e1428dfc9aca1ebba29d0738804cef41fa9db58a954700ac7fa3  RT-IR-5.0.11.tar.gz.asc

Security

The following security issue is fixed in this release. Thanks to
Mateusz Szymaniec and CERT Polska for reporting this issue.

* RTIR 5.0 is vulnerable to stored cross-site scripting via javascript:
links in HTML ticket content. RTIR's addition to RT's HTML scrubber
allows these links, and because it applies to the whole RT instance,
anyone who can add HTML content to a ticket can store one, including an
unauthenticated sender of email to the Incident Reports queue. This
vulnerability is assigned CVE-2026-105456.

General user features

* Support the reverse history option on RTIR ticket display pages, as
  on core RT pages
* Skip CVE extraction for messages that mention more than 100 distinct
  CVEs; see UPGRADING-5.0 to change the limit
* URI-escape constituency names in RTIR links so names containing
  spaces or other special characters produce valid URLs
* Show plain text, rather than HTML markup, in the "(Unchanged)" option
  of the Owner dropdown on the RTIR Update page

Internals

* Allow RTIR's own search arguments through RT's CSRF check

Testing

* Add tests for reverse history in all display modes
* Add tests for the limit on the number of CVEs extracted from a
  message
* Add tests for RTIR links with escaped constituency names
* Add tests for the Owner "(Unchanged)" label on the RTIR Update page
* Click the Submit button when creating articles in tests, as RT now
  requires it to save an article
* Update the GitHub actions Dockerfile to the latest test image


A complete changelog is available from git by running:
    git log 5.0.10..5.0.11
or visiting
    https://github.com/bestpractical/rtir/compare/5.0.10...5.0.11