Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

crynta/terax-ai

              main @ d77476e
            

Fixes

CVEs

HIGH

Peak severity

54.5%

Coverage

Highlights

Path Traversal: 5 prior fixes. Scrutinize any change in this area.

src/modules/ai/lib/security.ts: most-fixed (4 issues). Treat as high-risk during review.

10 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: The AI security guardrail has repeatedly failed to prevent path-traversal attacks, requiring multiple updates to sanitize NTFS ADS notation, Unicode bidi overrides, symlinks, and directory escapes. Failure to resolve paths against strict canonical boundaries allows unauthorized file reads.

Command Injection: AI-orchestrated shell command execution is highly vulnerable to command injection and statement smuggling via control characters, carriage returns, and home directory path bypasses. Rejection rules must aggressively catch shell-metacharacters and hidden control codes.

SSRF: Network proxy modules are vulnerable to SSRF targeting cloud metadata APIs and private local addresses, including DNS rebinding attacks that bypass typical host allowlists.