Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

decolua/9router

              master @ 0c47c89
            

Fixes

CVEs

CRITICAL

Peak severity

47.8%

Coverage

Highlights

Auth Bypass: 11 prior fixes. Scrutinize any change in this area.

src/dashboardGuard.js: most-fixed (8 issues). Treat as high-risk during review.

22 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Attackers can bypass dashboard access controls by manipulating Host headers or exploiting loopback socket checks when requests arrive via reverse proxies. These weaknesses are historically documented under CVE-2026-10269 and fixed across multiple patches.

Remote Code Execution: The application formerly allowed users to supply custom command-line tools to be executed via child_process.spawn. If malicious parameters or custom commands are reintroduced, arbitrary shell execution is possible.

SSRF: Image fetching and external API requests are susceptible to DNS rebinding and private IP address access. Attackers can leverage these endpoints to probe internal infrastructure or exploit cloud metadata APIs.