Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

beyonddimension/steamtools

              develop @ 8612251
            

Fixes

CVEs

HIGH

Peak severity

61.9%

Coverage

Highlights

Auth Bypass: 6 prior fixes. Scrutinize any change in this area.

src/ST.Client/Services/Implementation/HttpProxyServiceImpl.cs: most-fixed (3 issues). Treat as high-risk during review.

12 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: Shell command strings were constructed with raw inputs and executed with root privileges, allowing malicious actors to execute arbitrary code via macOS platform helpers.

Auth Bypass: Critical user operations, including accessing authenticators and copying sensitive security codes to the clipboard, were executed without verifying local password state.

Privilege Escalation: Sub-processes launched via IPC were allowed to inherit administrative rights, expanding the attack surface of local plugins.