Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

crestalnetwork/intentkit

              main @ 8dbdae0
            

Fixes

CVEs

HIGH

Peak severity

55.6%

Coverage

Highlights

Auth Bypass: 9 prior fixes. Scrutinize any change in this area.

intentkit/clients/privy.py: most-fixed (2 issues). Treat as high-risk during review.

12 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Accessing and mutating private team chat threads occurred without proper team membership verification, potentially allowing unauthorized users to inspect or corrupt cross-team conversations.

Auth Bypass: Lack of verification between teams and agents enabled unauthorized retrieval and manipulation of agent activities, posts, and management endpoints.

SSRF: The PDF generation utility and image downloader dynamically fetched resources without validating targets against internal, loopback, or private range IPs, exposing internal endpoints.