Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
fathah/hermes-desktop
main @ d677824
16
Fixes
0
CVEs
HIGH
Peak severity
33.3%
Coverage
Highlights
Information Disclosure: 3 prior fixes. Scrutinize any change in this area.
src/main/config.ts: most-fixed (4 issues). Treat as high-risk during review.
8 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Remote Code Execution: Insecure Electron renderer security defaults, navigation boundaries, and webview configurations historically allowed arbitrary remote code execution from untrusted content. Developers must enforce strict sandbox and isolation baselines.
Command Injection: Shell-evaluated execSync executions were historically vulnerable to arbitrary command injection. Migrating to parameterized executions (execFileSync) is critical when executing external system binaries.
Sandbox Bypass: BrowserWindow instantiations with nodeIntegration enabled and contextIsolation disabled bypassed the Electron sandbox. Secure windows must enforce context isolation and delegate IPC privileges via preload scripts.