Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
bradygaster/squad
dev @ 6c7e110
20
Fixes
0
CVEs
HIGH
Peak severity
31.6%
Coverage
Highlights
Command Injection: 8 prior fixes. Scrutinize any change in this area.
.github/workflows/squad-ci.yml: most-fixed (1 issue). Treat as high-risk during review.
14 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: The project has suffered from repeated shell and command injection vulnerabilities due to the unsafe invocation of `execSync` with unsanitized parameters in scheduler, platform, and preset tools. Developers must strictly avoid shell-interpreted functions and instead enforce process execution via safe argument arrays (such as `execFileSync` or `spawnSync`).
Path Traversal: Several entry points (including import, start, and runtime tool commands) have failed to adequately sanitize or restrict file-path parameters. This has allowed malicious actors to read, write, or delete arbitrary files on the system by traversing outside the intended storage directories.
Auth Bypass: Unsafe string matching patterns (such as non-exact grep checks) within infrastructure automation have enabled unauthorized PR authors to bypass security gates and modification checks.