Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

callstack/agent-device

              main @ d8e6bb7
            

Fixes

CVEs

HIGH

Peak severity

37.5%

Coverage

Highlights

Denial of Service: 7 prior fixes. Scrutinize any change in this area.

cli/commands/react-devtools.ts: most-fixed (1 issue). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Denial of Service: Failure to release or close Android snapshot helper sessions results in UiAutomation resource starvation, causing persistent denial of service.

Command Injection: Device labels and variables formatted directly into shell-like replay scripts are susceptible to command execution via unescaped string literals.

SSRF: Resolving remote installation packages without host filtering or allowlists permits attackers to scan internal networks and execute server-side requests.