2026-11-13
Stendhal 1.49.1 is a server-only release, which fixed a security bug.
The bug enabled players to add arbitrarily formatted text, which might including third-party images, to the chat log using /sentence, /grumpy and similar commands. We would like to thank Iain (@NotAFlightRisk) for the report.
On the positive side, this bug cannot be abused to execute malicious JavaScript code (no XSS vulnerability) because Stendhal uses strict Content-Security-Policy. It disallows inline JavaScript.