Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ggozad/oterm

              main @ e090ffe
            

Fixes

CVEs

MEDIUM

Peak severity

Highlights

Information Disclosure: 2 prior fixes. Scrutinize any change in this area.

src/oterm/agent.py: most-fixed (1 issue). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Information Disclosure: Third-party Model Context Protocol (MCP) servers could inherit the parent environment, potentially exposing sensitive API keys and system credentials configured in the host environment.

Information Disclosure: When using third-party OpenAI-compatible endpoints, the underlying OpenAI SDK can automatically fall back to the primary environment's OPENAI_API_KEY if not explicitly overridden, leaking the user's primary key to untrusted hosts.