Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

cloakhq/cloakbrowser

              main @ 0bb3737
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Command Injection: 2 prior fixes. Scrutinize any change in this area.

cloakbrowser/download.py: most-fixed (3 issues). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: String interpolation of target archive or destination paths directly into PowerShell commands can allow arbitrary shell execution during binary extraction. This risk is replicated in JavaScript-based downloading pipelines as well.

Signature Verification Bypass: Downloading binaries from external mirrors without strict cryptographic verification allows attackers who compromise a mirror to serve backdoored payloads. Robust Ed25519 signature validation is required prior to extraction.

Path Traversal: As tracked in CVE-2026-45727, a failure to validate user-supplied fingerprint seeds can lead to unauthenticated remote directory deletion when paths are passed directly to filesystem handlers like shutil.rmtree.