Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

helix-editor/helix

              master @ 6b7c7c6
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

helix-loader: most-fixed (2 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Untrusted workspace configurations can automatically execute local configs and run unauthorized language servers (LSP), allowing code execution on branch switches or upon opening untrusted directories. This is mitigated using a workspace trust system and configuration hashing.

Path Traversal: Improper handling and resolution of symbolic links during file writes can lead to out-of-bounds file modification. Robust path canonicalization and parent-relative resolution are required to prevent traversal outside of the intended workspace boundaries.

Insecure Temporary File: Directly writing to target paths can result in document corruption or race conditions. Implementing atomic document writes via a secure temporary file directory followed by a rename is critical to preserving file integrity.