Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
frappe/books
master @ 7c35767
3
Fixes
47
CVEs
CRITICAL
Peak severity
Highlights
Auth Bypass: 1 prior fix. Scrutinize any change in this area.
&: most-fixed (1 issue). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Sandbox Escape: Unrestricted communication over the Electron IPC channel allowed the unprivileged Renderer process to execute high-privilege operations in the Main process, bypassing runtime isolation. Developers must strictly enforce context isolation and expose safe APIs solely via a preload bridge.
Broken Authentication: Storing or querying passwords in plain-text inside database filters introduces critical credential-compromise vectors. Passwords must always be verified using secure, slow cryptographic hashing algorithms like bcrypt prior to database querying.
Auth Bypass: Sensitive server-side resource APIs lacked token-based validation, exposing internal data and operations to unauthenticated web requests. Global or explicit JWT middleware validation must gate all private REST endpoints.