Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
balena-io/etcher
master @ 1e2500e
7
Fixes
1
CVEs
HIGH
Peak severity
Highlights
Command Injection: 5 prior fixes. Scrutinize any change in this area.
lib/shared/permissions.js: most-fixed (2 issues). Treat as high-risk during review.
6 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: This component manages the writer proxy that frequently invokes privileged processes. Multiple command injection vectors have been addressed here, specifically involving how command-line arguments are structured, escaped, and passed to underlying elevated execution utilities.
Command Injection: Windows privilege elevation paths inside the permissions helper historically suffered from weak parameter quoting and character escaping, allowing attackers to hijack execution when the application elevates privileges.
Privilege Escalation: Running the entire Electron GUI as root violates the principle of least privilege, enabling any vulnerability in the GUI renderer process to compromise the entire system host.