Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
grain-lang/grain
main @ 0dcc049
4
Fixes
2
CVEs
HIGH
Peak severity
Highlights
Command Injection: 1 prior fix. Scrutinize any change in this area.
cli/bin/exec.js: most-fixed (1 issue). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Memory Safety: Low-level memory functions like Memory.copy can trigger premature garbage collection of active objects. Artificially extending object lifetimes via manual ignore() references is required to prevent use-after-free and memory safety errors during execution.
Memory Corruption: Failure to increment reference counts (e.g., using Memory.incRef) before performing low-level stores like WasmI32.store leads to memory corruption when handling directory entries.
Sandbox Escape: Exposing unmapped host paths directly to the WASI subsystem allows guest programs to escape their sandbox and access the host file system. Strict path canonicalization and virtual mapping (such as a /sandbox mount point) are necessary.