Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
assafelovic/gpt-researcher
main @ 18d4051
8
Fixes
5
CVEs
HIGH
Peak severity
83.3%
Coverage
Highlights
Path Traversal: 5 prior fixes. Scrutinize any change in this area.
backend/server/server_utils.py: most-fixed (2 issues). Treat as high-risk during review.
8 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: User-supplied filenames in file uploads and deletions allowed arbitrary directory traversal, risking unauthorized file system access or server-side deletion of sensitive files. Developers must enforce strict canonicalization and prefix verification.
Path Traversal: Dynamic task queries were used directly to construct agent output directories without proper isolation or sanitization, potentially allowing multi-agent processes to write files to arbitrary host locations.
Command Injection: Remote code execution via the manipulation of arguments in WebSocket commands exposes the underlying system to total compromise. Input parameters must be strictly parsed against strict schemas before execution.