Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
esengine/deepseek-reasonix
main-v2 @ b193d42
27
Fixes
0
CVEs
HIGH
Peak severity
25.9%
Coverage
Highlights
Auth Bypass: 9 prior fixes. Scrutinize any change in this area.
internal/agent: most-fixed (3 issues). Treat as high-risk during review.
17 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Gating mechanisms deciding whether custom tools run in plan-mode were vulnerable to bypassing restrictions, allowing untrusted remote servers or processes to run disallowed tools via unverified read-only hints.
Sandbox Escape: The plan-mode bash execution environment has suffered repeated escapes due to shell metacharacters, parameter chaining, and unapproved utility allowlists.
Path Traversal: Archive extraction routines in codegraph were vulnerable to Zip Slip and symlink redirection, allowing writes outside the target directory if symlinks were not fully resolved before prefix checks.