Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

hashicorp/hc-install

              main @ b9cf8ba
            

Fixes

CVEs

MEDIUM

Peak severity

Highlights

Path Traversal: 2 prior fixes. Scrutinize any change in this area.

internal/releasesjson/downloader.go: most-fixed (1 issue). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Archive extraction without proper path validation allows malicious ZIP archives to write files to arbitrary locations on the filesystem. This can lead to remote code execution or system compromise if binary targets are overwritten.

Path Traversal: Unanchored regular expressions used for validating product and binary names can allow attackers to inject path traversal sequences (such as '../'), bypassing validation layers and accessing unauthorized system paths.