Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

e2b-dev/desktop

              main @ 1266e99
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Argument Injection: 1 prior fix. Scrutinize any change in this area.

packages/js-sdk/src/sandbox.ts: most-fixed (2 issues). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The sandbox video stream generation endpoint lacked token verification, exposing active sandbox screens to unauthorized network access. Attackers could monitor sandbox environments by predicting or harvesting stream URLs without authenticating.

Argument Injection: User input passed directly to OS-level automation utilities like xdotool was vulnerable to option hijacking. Input strings beginning with a dash could be interpreted as command flags rather than literal text arguments, leading to unexpected tool behaviors.