How Should Clash Party Users Handle the Built-in Sub-Store Risk?

Sub-Store edits, converts, and manages subscriptions; it is not the Mihomo core. After disabling it, use a Profile already imported into Clash Party to check that policy groups, the system proxy, and TUN still work. They are usually unaffected; subscription processing on the Sub-Store page is what stops.

Clash Party can update its built-in backend independently, so the client version does not establish whether Sub-Store is safe. Clash Party #2134 is a user report from a v2.0.2 environment. A contributor recommended updating Sub-Store, but it does not provide a maintainer-confirmed risk conclusion.

The public report in Sub-Store issue #634 covers Node backend versions 2.11.4 through 2.37.1. The 2.38.0 release notes explicitly close the issue. As checked on 2026/9/23, the stable version is 2.41.0; update to it or a later verified stable release. The fix does not authenticate all network access, and a version number cannot prove the device was never affected.

The v2.0.2 source enables built-in Sub-Store by default. Check the local switch and listening address to know whether it is running. Not opening the page, hiding the entry, deleting a subscription or seeing no pop-up does not prove it has stopped. If the version is unknown, disable the service as described next, then check its actual local address.

If Sub-Store is running in Clash Party and you do not know the backend version, close untrusted web pages and do not look for or run public exploit code. Open Settings > Sub-Store. While the switches are visible, turn off Allow LAN access, then Enable Sub-Store to stop the built-in frontend and backend. If already disabled, do not re-enable the service just to change a hidden switch.

Allow LAN access binds to 0.0.0.0 when enabled, allowing direct access from LAN devices, and uses 127.0.0.1 when disabled. The report also covers web pages accessing local loopback addresses, so turning off LAN access does not replace an update. Restart the app and complete a real HTTPS request with the existing Profile to confirm normal proxying still works.

Before updating, open Settings > Sub-Store and confirm whether you use the built-in backend or a custom backend. In built-in mode, Clash Party starts a local bundle. Custom mode stops the built-in backend and connects to the URL you provide; an in-app update cannot replace the external deployment's own upgrade, listener restrictions, and authentication.

When using the built-in backend, close untrusted web pages, temporarily enable Sub-Store, and keep Allow LAN off in the same settings section. On the Sub-Store page, use Open in Browser and rely on the actual address shown in the interface. Do not assume every device uses the same fixed port.

The Clash Party v2.0.2 source code shows that the backend starts looking for an available port at 127.0.0.1:38324 and increments the port if it is occupied. When you open the backend root address, the Sub-Store response reports the actual version in data.version. Record only the version and address; do not submit script parameters or perform exploit testing.

If the version is between 2.11.4 and 2.37.1, update immediately. A version older than 2.11.4 falls outside this report's scope but is still clearly outdated and should be updated to the current stable release. If the page will not open or you cannot confirm the version, return to the disabled state; do not treat unknown as safe.

These steps apply only to the built-in Clash Party backend. The Sub-Store page has a cloud-shaped Check for updates button in the upper-right corner.

The v2.0.2 source shows that it downloads the backend and frontend from the official latest Release of sub-store-org/Sub-Store and sub-store-org/Sub-Store-Front-End respectively, then restarts both services.

The minimum target is 2.38.0. The target checked for this article is 2.41.0, released on 2026/9/22. Check the official Releases when choosing another stable version later.

Updating the Mihomo core, refreshing a subscription, or reinstalling the same Clash Party client does not replace checking the Sub-Store backend. It is downloaded and run as a separate component, so you must update it on its own page and read its own version number.

Commit 038745f tightens default CORS, restricts some Node script operations, and adds rejection tests. Requests without Origin still receive different handling, and Clash Party’s custom backend name also leaves some script restrictions inapplicable. These changes do not ensure that every API call is authenticated.

Recheck the official Release notes, commits, and documentation when security advisories or authentication mechanisms change.

After restarting Clash Party, read the actual backend address and data.version from the Sub-Store page. Confirm the updated version remains and the address is 127.0.0.1, not a LAN address or 0.0.0.0. An update-success message alone is insufficient.

Then turn off Enable Sub-Store and confirm that the frontend and backend pages are no longer reachable. Complete a real HTTPS request with your existing Profile. This verifies both that the disable switch actually stops the separate services and that normal proxying does not depend on Sub-Store running continuously.

A version within the reported range does not mean the device was exploited. Escalate the incident to a possible device compromise only when there is evidence such as unknown processes, unusual network connections, security-software alerts, or unexpected changes to configuration or credentials. At that point, updating can block the entry path going forward, but it cannot remove an existing program or restore leaked credentials.

Disable Sub-Store first and disconnect the device from the network. Record the Clash Party and Sub-Store versions, listen address, alert time, and suspicious behavior. Do not immediately delete logs, configuration, or unfamiliar files in an attempt to clean up; they may be important evidence for determining the scope of impact.

Run a full scan with security tools approved by the operating-system vendor or your organization. If a subscription URL, node credentials, WebDAV, GitHub Token, or other secrets were present on the device, invalidate and reissue them from a trusted device. Create a redacted copy before sharing logs. If you cannot establish the device's integrity, reinstall the system or client from an official source and restore only configuration confirmed to be clean.

If version 2.38.0 or later breaks a subscription conversion or script, do not downgrade to 2.37.1 or earlier to restore the feature. Disable Sub-Store first and continue using the verified working Clash Party Profile. When you need to restore the subscription, obtain the original link again from a trusted provider or import a clean backup made before the upgrade.

Re-enable Sub-Store for testing only with the new version, Allow LAN off, and the listener restricted to 127.0.0.1. If a third-party script still depends on the restricted old behavior, stop using it and contact its maintainer for an update instead of opening up the entire local API.