Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

e2b-dev/e2b

              main @ 2a98cce
            

Fixes

CVEs

CRITICAL

Peak severity

55.2%

Coverage

Highlights

Denial of Service: 11 prior fixes. Scrutinize any change in this area.

packages/js-sdk/src/sandbox/index.ts: most-fixed (3 issues). Treat as high-risk during review.

11 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Code Injection: The application exposed a remote code execution vector by evaluating arbitrary user code via Node's non-secure 'vm.runInNewContext' sandbox wrapper. Developers must completely avoid deploying in-memory execution capabilities without isolated hypervisors or secure runtimes.

Command Injection: Unescaped inputs were serialized directly into shell commands during runtime, allowing attackers to inject shell metacharacters and execute unauthorized host-level commands.

Path Traversal: File transfer and copy mechanisms resolved target file paths relative to active context roots without validating that canonicalized paths remained within the sandbox or context boundary.