Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

droidrun/mobilerun

              main @ e72c1d2
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Denial of Service: 2 prior fixes. Scrutinize any change in this area.

droidrun/agent/utils/executer.py: most-fixed (3 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Sandbox Escape: The Python executor is highly susceptible to escape vectors when running dynamic strings. Developers must ensure that restricted execution environments restrict builtins and implement robust import restriction hooks.

Code Execution: Without input validation, the dynamic executor directly evaluates arbitrary code. Implementing a strict pre-execution blocklist or safelist hook is vital before passing strings to the execution sink.

Denial of Service: Dynamic code execution blocks can easily lead to infinite loops, blocking the main execution thread or worker pools if timeouts are not enforced at the async executor level.