Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

aws/aws-sam-cli

              develop @ f4ebc1a
            

Fixes

CVEs

HIGH

Peak severity

53.8%

Coverage

Highlights

Path Traversal: 4 prior fixes. Scrutinize any change in this area.

samcli/lib/utils/tar.py: most-fixed (3 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: The project repeatedly struggled to securely extract tarballs, failing to safely canonicalize path prefixes across different operating systems. This led to multiple traversal vulnerability fixes.

Path Traversal: Similar to the tarball issue, local lambda ZIP extractions did not validate that target paths stayed within the output directory boundaries.

Deserialization: Using unsafe YAML loaders (yaml.FullLoader) allowed arbitrary code execution during template translation processing.