Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
campfirein/byterover-cli
main @ faf456d
36
Fixes
0
CVEs
HIGH
Peak severity
36.4%
Coverage
Highlights
Path Traversal: 14 prior fixes. Scrutinize any change in this area.
CLI: most-fixed (2 issues). Treat as high-risk during review.
16 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Agent-supplied parameters can write files outside the workspace root if paths are not canonicalized and matched against the workspace prefix. This allows arbitrary file write or overwrite attacks.
Path Traversal: Session finalization was vulnerable to directory traversal via agent-controlled paths. Robust ancestor validation is required to ensure files stay in the context tree.
Sandbox Bypass: Reusing sandbox environments across session transitions could permit code running in read-only query mode to retain mutable curating capabilities if the SDK references are not hot-swapped.