Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

containerd/nri

              main @ 32e4300
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Sandbox Escape: 2 prior fixes. Scrutinize any change in this area.

plugins/default-validator: most-fixed (2 issues). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Arbitrary plugin registration names can be manipulated to perform path traversal or command injection. Attackers with control over registration inputs can escape designated plugin directories if names are not strictly constrained to an allowlist.

Sandbox Escape: NRI plugins modifying container kernel settings (such as arbitrary sysctl parameters or customized seccomp profiles) can degrade container boundary security and facilitate sandbox escapes if those adjustments are not actively validated and restricted.