Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

affaan-m/ecc

              main @ 71d22d0
            

Fixes

CVEs

CRITICAL

Peak severity

33.3%

Coverage

Highlights

Command Injection: 19 prior fixes. Scrutinize any change in this area.

scripts/hooks/gateguard-fact-force.js: most-fixed (6 issues). Treat as high-risk during review.

34 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: Dynamic shell evaluation using execSync with concatenated string parameters allowed shell injection; resolved by migrating to structured spawnSync or filesystem checks.

Auth Bypass: Validation bypasses in command validators occurred due to incomplete normalization, quote removal rules, or parsing flat structures instead of deeply nested edit structures in tool inputs.

Path Traversal: Install-state operations and file cleanups lacked structural root confinement, potentially permitting arbitrary system files to be manipulated or removed.