Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

eigent-ai/eigent

              main @ 5b9bde9
            

Fixes

CVEs

CRITICAL

Peak severity

12.5%

Coverage

Highlights

Path Traversal: 3 prior fixes. Scrutinize any change in this area.

src/components/Folder/FolderComponent.tsx: most-fixed (2 issues). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Insecure handling of local file paths in the custom protocol handler allowed attackers to read arbitrary local files from the host system by avoiding directory containment validations.

Arbitrary Code Execution: Use of the pull_request_target trigger combined with a checkout of untrusted pull request code allowed remote code execution within the privileged CI runner context, as tracked in CVE-2026-22869.

DOM-Based XSS: Bypasses in HTML rendering components allowed execution of arbitrary script payloads inside dangeroustlySetInnerHTML, introducing potential access to electron ipcRenderer interfaces.