How Should Clash Party Users Handle the Built-in Sub-Store Risk?

The public report in Sub-Store issue #634 identifies Node backend versions 2.11.4 through 2.37.1 as affected and describes the risk created by overly broad cross-origin access combined with script-processing capabilities. Upstream then used commit 038745f to tighten the default CORS policy, restrict some Node script operations, and add rejection tests. The 2.38.0 release notes explicitly close the issue.

As of 9/12/2026, the current stable Sub-Store release is 2.39.6. This guide treats 2.38.0 as the minimum version where upstream explicitly closed #634 and recommends updating to the current stable release. That does not mean 2.38.0 added authentication for every form of network exposure, nor can a version number tell you whether a device has already been affected.

Clash Party issue #2134 is a user report about a v2.0.2 environment. A bot later closed it under the project's security-reporting process, and a contributor recommended updating Sub-Store. Clash Party can update its built-in backend independently, so the client version alone does not reveal which Sub-Store version is running.

The v2.0.2 source code enables the built-in Sub-Store by default, but the local settings and actual listener determine its current state. Never opening the page, hiding its entry point, or deleting a subscription does not mean the backend is disabled.

If Clash Party is running Sub-Store and you do not yet know the backend version, close untrusted web pages first and do not search for or run public exploit code. Open Settings > Sub-Store in Clash Party and turn off Enable Sub-Store. The official source code shows that this stops the built-in frontend and backend services.

Also confirm that Allow LAN remains off. When it is on, the service binds to 0.0.0.0 and devices on the LAN can access it directly; when it is off, the service uses 127.0.0.1. The public report includes a path in which a browser page reaches the loopback address, so disabling LAN access does not replace updating, but it does prevent the network exposure from expanding further.

Sub-Store is a tool for editing, converting, and managing subscriptions; it is not the Mihomo core itself. After you disable it, the Profile, policy groups, system proxy, and TUN already imported into Clash Party will usually continue to work. You simply will not be able to process subscriptions on the Sub-Store page.

Before updating, open Settings > Sub-Store and confirm whether you use the built-in backend or a custom backend. In built-in mode, Clash Party starts a local bundle. Custom mode stops the built-in backend and connects to the URL you provide; an in-app update cannot replace the external deployment's own upgrade, listener restrictions, and authentication.

When using the built-in backend, close untrusted web pages, temporarily enable Sub-Store, and keep Allow LAN off in the same settings section. On the Sub-Store page, use Open in Browser and rely on the actual address shown in the interface. Do not assume every device uses the same fixed port.

The Clash Party v2.0.2 source code shows that the backend starts looking for an available port at 127.0.0.1:38324 and increments the port if it is occupied. When you open the backend root address, the Sub-Store response reports the actual version in data.version. Record only the version and address; do not submit script parameters or perform exploit testing.

If the version is between 2.11.4 and 2.37.1, update immediately. A version older than 2.11.4 falls outside this report's scope but is still clearly outdated and should be updated to the current stable release. If the page will not open or you cannot confirm the version, return to the disabled state; do not treat unknown as safe.

The following steps apply only to the built-in Clash Party backend. The Sub-Store page has a cloud-shaped Check for updates button in the upper-right corner. The v2.0.2 source code shows that it downloads the backend and frontend files from the latest official sub-store-org/Sub-Store Release, then restarts both services.

After starting the update, wait for the completion message. Do not exit the client midway or manually overwrite the bundle in the application directory at the same time. The minimum target is 2.38.0; the current target is 2.39.6, released on 9/11/2026. If a newer stable version is available later, follow the official Releases.

Updating the Mihomo core, refreshing a subscription, or reinstalling the same Clash Party client does not replace checking the Sub-Store backend. It is downloaded and run as a separate component, so you must update it on its own page and read its own version number.

A successful update message is only the first verification step. After restarting Clash Party, read the actual backend address and data.version from the Sub-Store page again and confirm that the version did not revert. Also confirm that the address uses 127.0.0.1 rather than a LAN address or 0.0.0.0.

Then turn off Enable Sub-Store and confirm that the frontend and backend pages are no longer reachable. Complete a real HTTPS request with your existing Profile. This verifies both that the disable switch actually stops the separate services and that normal proxying does not depend on Sub-Store running continuously.

A version within the reported range does not mean the device was exploited. Escalate the incident to a possible device compromise only when there is evidence such as unknown processes, unusual network connections, security-software alerts, or unexpected changes to configuration or credentials. At that point, updating can block the entry path going forward, but it cannot remove an existing program or restore leaked credentials.

Disable Sub-Store first and disconnect the device from the network. Record the Clash Party and Sub-Store versions, listen address, alert time, and suspicious behavior. Do not immediately delete logs, configuration, or unfamiliar files in an attempt to clean up; they may be important evidence for determining the scope of impact.

Run a full scan with security tools approved by the operating-system vendor or your organization. If a subscription URL, node credentials, WebDAV, GitHub Token, or other secrets were present on the device, invalidate and reissue them from a trusted device. Create a redacted copy before sharing logs. If you cannot establish the device's integrity, reinstall the system or client from an official source and restore only configuration confirmed to be clean.

If version 2.38.0 or later breaks a subscription conversion or script, do not downgrade to 2.37.1 or earlier to restore the feature. Disable Sub-Store first and continue using the verified working Clash Party Profile. When you need to restore the subscription, obtain the original link again from a trusted provider or import a clean backup made before the upgrade.

Re-enable Sub-Store for testing only with the new version, Allow LAN off, and the listener restricted to 127.0.0.1. If a third-party script still depends on the restricted old behavior, stop using it and contact its maintainer for an update instead of opening up the entire local API.

The component at the center of this risk is the Sub-Store Node backend started by Clash Party, not the Mihomo core and not every client with Clash in its name. Future reviews should record the Clash Party version, Sub-Store data.version, Allow LAN state, and actual listen address together.

The official 2.38.0 release closed #634, and 2.39.6 is the current stable version at the time of this review; Clash Party #2134 remains a user report. If upstream later publishes a new security advisory, authentication mechanism, or Clash Party integration release, update these conclusions using the new official Release, commits, and documentation.