Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
cog-creators/red-discordbot
V3/develop @ 61484f2
69
Fixes
0
CVEs
HIGH
Peak severity
33.3%
Coverage
Highlights
Auth Bypass: 36 prior fixes. Scrutinize any change in this area.
redbot/core/core_commands.py: most-fixed (16 issues). Treat as high-risk during review.
18 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Decorators and rule transition mechanisms failed to correctly propagate and enforce privileges on subcommands, or evaluated empty roles/global permissions incorrectly, leading to unauthorized command execution.
Auth Bypass: Commands copied via factory methods lost crucial permission decorators, and command groups failed to enforce required checks prior to invoking internal logic or interactive help.
Privilege Escalation: The massban command failed to fetch uncached guild members before hierarchy check, allowing moderators to ban members higher than them in the hierarchy.