Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

docker/compose

              main @ 9cd8442
            

Fixes

CVEs

CRITICAL

Peak severity

37.5%

Coverage

Highlights

Path Traversal: 5 prior fixes. Scrutinize any change in this area.

pkg/compose/secrets.go: most-fixed (2 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Git subdirectory parsing and OCI artifact extraction did not validate target extraction paths against the intended base or cache directories, allowing write operations to escape the repository workspace. Developers should strictly apply path canonicalization and prefix verification using a validated base directory.

Privilege Escalation: Injected configurations and secrets defaulted to root permissions. Forcing the target container user's UID and GID prevents unauthorized root execution on bound host volumes or container directories.

Path Traversal: Default command resolution on Windows platforms could lead to executing untrusted binaries from the current directory, requiring a custom binary lookup mechanism that excludes the relative working directory.