Recyclarr 8.7 Security Response: Treat Template Sources as a Write Boundary
Tech GuruQuick Answer
Pause affected Recyclarr template jobs, preserve the provider revisions and generated files, and inventory what the process could read or overwrite. The advisory metadata lists versions through 8.6.0 as affected and 8.7.0 as patched. Move to a reviewed supported fixed release before processing templates or syncing production. Test without production secrets or writable production mounts, review output and application diffs, and rotate credentials whose exposure cannot be bounded.
Source
Identify every template provider, branch, pinned commit, and local override used by the stack.
Render
Generate in an isolated process/container with no production secrets or writable production mounts. A disposable output directory alone does not contain traversal.
Compare
Compare generated YAML and application changes before pushing to Sonarr or Radarr.
Sync
Take application backups and keep a rollback point before syncing profile changes.
Decision Matrix
| Area | What to Check | Operational Standard |
|---|---|---|
| Version | Recyclarr release, container digest, config schema | Run a fixed release and document the tested version. |
| Providers | Remote template repositories, branches, commits, local templates | Pin and review template sources. |
| Writes | Config directory, generated YAML, app API writes | Only expected paths and application fields change. |
| Recovery | Pre-sync config snapshot and app backups | Rollback is available before profile changes reach users. |
Inventory the Template Runner
Recyclarr is a CLI automation tool; the relevant entry point here is provider content consumed by a local command, scheduled container, or CI job. The Recyclarr Advisory GHSA-9wh7-8wrf-9x8r describes a malicious manifest redirecting file reads and writes during template creation. Published metadata gives 8.7.0 as the fix, despite stale draft wording in the description. The write primitive is constrained to a .yml destination and the process's permissions; the read primitive can reach files that process can read.
- Record the actual executable/image digest, scheduler, command, UID/GID, environment-secret sources and mounted paths before changing the runner.
- Preserve provider URLs, revisions, local overrides, manifests, generated configuration and relevant job logs. A familiar template ID does not establish a safe source path.
- Map readable credentials and writable YAML locations, including settings, generated instances, Compose/CI definitions and shared volumes. Pause jobs and prevent automatic provider refresh while assessing suspicious state.
Patch Before Processing More Templates
Upgrade the runner before it processes more provider input. Pin and review a revision using the selected provider's supported mechanism; do not assume every source supports arbitrary commit pinning. Inspect configured destinations and generated YAML before permitting API access to Sonarr or Radarr.
- Use an isolated test account/container with only disposable input/output, no production credentials, and no writable production or orchestration mounts.
- A benign output test checks expected changes; a dedicated vendor-reviewed negative fixture can test the recorded containment boundary. Do not create or run traversal payloads against live paths.
- If unintended reads/writes or provider tampering are found, preserve evidence, assess affected runner and downstream state, and rebuild from known-good software and reviewed configuration. Absence of inbound network exposure does not exclude this supply-chain path.
Rotate What The Vulnerable Path Could Reach
Recyclarr configuration can hold Sonarr/Radarr keys and other reachable secrets; it is not a web dashboard with its own login key in this workflow. Identify what the runner could read, what generated files or logs captured, and whether altered application URLs could redirect later requests. Revoke abused credentials promptly and provision replacements from a clean path.
- Review Sonarr/Radarr API keys, readable environment or CI secrets, provider credentials and any other files within the process's actual access.
- Check settings.yml, generated instance base URLs and orchestration YAML before reconnecting dependencies; changing the image alone does not replace these files.
- Keep a dated revocation record. Restrict historical evidence and backups rather than rewriting them to hide old secrets; do not restore revoked keys into service.
Recover the Runner and Application State
Recreate an untrusted runner from a known-good image or package and compare persistent state against reviewed sources. Preserve original files, logs and metadata before cleanup. Restore only approved settings and templates, with new secrets and narrowly scoped filesystem/API permissions. Then inspect Sonarr/Radarr changes and test restoration of their pre-sync backups in isolation. A new runner does not undo previous API writes or resolve missing evidence.
Validation Checklist
- Recyclarr reports the expected fixed version.
- Template providers and pinned revisions are documented.
- The approved negative fixture is rejected on the recorded version and isolated filesystem boundary; ordinary authorized reads and other code paths still need separate review.
- Generated output differs only where expected.
- Sonarr and Radarr backups exist before sync and old API keys are not printed in logs.
What This Does Not Prove
A clean Recyclarr run does not prove a template repository is safe, that historical generated files were not altered, or that Sonarr/Radarr state matches your intent. It only verifies the tested version and test path.
Security, Privacy, Legal, And Recovery Boundaries
- Do not run path-traversal fixtures against production paths.
- Do not publish API keys, application URLs, profile names tied to private libraries, or full generated configuration if it exposes your environment.
- Use this for lawful personal media organization and quality-profile management only.
- Back up application databases before sync operations that can rewrite many profiles at once.
Version and Test Boundary
Recheck the published advisory metadata, supported target release and provider syntax before deployment. Record the exact runner and source revision, filesystem/API permissions, intended changes and recovery set. No template rendering, negative fixture, sync or restoration was performed for this guide.
