Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

any4ai/anycrawl

              main @ 0e170bf
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Auth Bypass: 1 prior fix. Scrutinize any change in this area.

packages/template-client: most-fixed (2 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: User-defined templates can execute arbitrary code on the host if run outside of a restricted execution environment. The application must strictly validate a 'trusted' flag configuration before bypassing sandbox constraints.

Sandbox Escape: Inadequate enforcement of security boundaries in the template sandbox allows malicious template definitions to break out of their execution context. Enforcing a 'trusted' flag isolation mechanism is necessary to neutralize untrusted scripts.

Auth Bypass: An absence of authorization validation during template retrieval and merging allows users to access and manipulate private crawling, scraping, and searching templates belonging to other accounts.