Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

getsentry/xcodebuildmcp

              main @ db7e055
            

Fixes

CVEs

HIGH

Peak severity

62.5%

Coverage

Highlights

Command Injection: 7 prior fixes. Scrutinize any change in this area.

.github/workflows/release.yml: most-fixed (2 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: The project's central command execution logic has repeatedly allowed command injection due to unsafe hand-rolled escaping. Flaws in parameter handling and NSPredicate sanitization allow shell metacharacter injection into the underlying shell interpreter.

Command Injection: GitHub Actions workflows used inline expression interpolation in step runners, allowing untrusted workflow contexts and release metadata to execute arbitrary shell commands inside the builder runner.

Command Injection: Execution of system commands via custom shell wrappers (/bin/sh -c) with direct variable interpolation allowed executing arbitrary programs when handling malicious bundle paths or identifiers.