Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

coplaydev/unity-mcp

              beta @ dccecd6
            

Fixes

CVEs

HIGH

Peak severity

7.1%

Coverage

Highlights

Auth Bypass: 4 prior fixes. Scrutinize any change in this area.

.github/workflows/unity-tests.yml: most-fixed (2 issues). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Attackers could supply a unity_instance identifier to bypass security verification and tool execution logic entirely, routing arbitrary commands directly to the connection hub.

Path Traversal: The lack of path canonicalization and directory-containment verification on the installation root allowed attackers to perform arbitrary file writes outside the intended project workspace during the skill sync planning phase.

Command Injection: Insufficently escaped shell arguments when creating local terminal process start configurations across macOS, Windows, and Linux allowed malicious inputs to execute arbitrary operating system commands.