Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
activeloopai/hivemind
main @ 3974969
49
Fixes
0
CVEs
HIGH
Peak severity
36.1%
Coverage
Highlights
Path Traversal: 9 prior fixes. Scrutinize any change in this area.
src/hooks/pre-tool-use.ts: most-fixed (8 issues). Treat as high-risk during review.
31 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: Untrusted tool inputs or system commands are parsed incorrectly, allowing command substitution or unexpected shell expansion (e.g. through double-quoted JSON strings or unescaped operators) to execute arbitrary code outside the sandbox.
SQL Injection: Using string interpolation with table names and identifiers in raw SQL queries allows attackers to bypass security restrictions. Utilizing structured parameterization or sqlIdent escaping is necessary.
Path Traversal: Manifest fields (e.g., dirName, symlinks) and skill names lack canonical path verification, enabling attackers to perform arbitrary file writes or deletions outside the intended root installation directories.