Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
frangoteam/fuxa
master @ 68a635a
41
Fixes
19
CVEs
CRITICAL
Peak severity
50.0%
Coverage
Highlights
Auth Bypass: 24 prior fixes. Scrutinize any change in this area.
server/api/index.js: most-fixed (6 issues). Treat as high-risk during review.
29 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Unauthenticated remote attackers could manipulate request paths/URLs to bypass Express middleware checks and access sensitive administrative, flow, and editor routes within the Node-RED plugin, leading to remote code execution.
Path Traversal: The lack of file-path canonicalization and sanitization allowed authenticated and unauthenticated users to use directory traversal sequences inside file upload and writing functions to write arbitrary files outside the sandboxed projects directory.
Hardcoded Credentials: The system used a hardcoded default secret key to sign and verify JWT administrative tokens, enabling unauthenticated remote attackers to forge valid administrative tokens.