Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

OneUptime/oneuptime

              master @ f454b42
            

195

Fixes

CVEs

CRITICAL

Peak severity

37.1%

Coverage

Highlights

Auth Bypass: 131 prior fixes. Scrutinize any change in this area.

CommonServer/Middleware/UserAuthorization.ts: most-fixed (8 issues). Treat as high-risk during review.

150 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Sandbox Escape: Execution of untrusted Playwright/Node.js script monitors repeatedly allowed breakout vectors into the host environment due to unblocked browser object context leakage, prompting major migrations from vm2 and node:vm to isolated architectures.

Auth Bypass: Tenant boundaries and Single Sign-On (SSO) flows suffered bypasses where missing signature verification, incorrect project context mapping, or relying on client-supplied headers allowed unauthorized cross-project database manipulation.

SQL Injection: User-controlled telemetry parameters and database column names were dynamically concatenated inside ClickHouse queries instead of using schema verification or parameterized execution context, allowing arbitrary database inspection.