Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
genkit-ai/genkit
main @ a43415f
8
Fixes
0
CVEs
CRITICAL
Peak severity
57.1%
Coverage
Highlights
Auth Bypass: 4 prior fixes. Scrutinize any change in this area.
js/flow: most-fixed (2 issues). Treat as high-risk during review.
5 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Flow execution endpoints and wrappers repeatedly failed to invoke or correctly validate configured authorization policies, leaving flow run environments exposed. This was fixed by ensuring the policy checker is invoked on the envelope auth data before running the flow, and by passing flow input arguments directly to the checker.
Auth Bypass: A logic bug in the Firebase authentication policy handler used an invalid default fallback ('config?.required || true'), which ignored explicit configuration specifying 'required: false' security options.
Injection: GitHub Actions workflow was vulnerable to arbitrary command execution on runners due to direct interpolation of untrusted inputs in run commands. This was resolved using environment variable indirection.