Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
google/adk-go
main @ 5350266
4
Fixes
0
CVEs
HIGH
Peak severity
50.0%
Coverage
Highlights
Auth Bypass: 1 prior fix. Scrutinize any change in this area.
artifact/service.go: most-fixed (1 issue). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Session listing bypassed proper authentication context isolation, potentially allowing unauthorized access to execution context details. Future changes must ensure execCtx.User attributes are validated and populated.
Path Traversal: The artifact service failed to reject path separators when iterating or storing files, which could lead to arbitrary path writing. File name validation must explicitly reject directory traversal segments.
Reflected XSS: Using text/template for agent transfer representations allowed injection attacks. Developers must strictly enforce the use of html/template for user-controlled outputs.