Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
heygen-com/hyperframes
main @ c811a27
54
Fixes
0
CVEs
HIGH
Peak severity
11.1%
Coverage
Highlights
Path Traversal: 14 prior fixes. Scrutinize any change in this area.
packages/core/src/studio-api/routes/files.ts: most-fixed (3 issues). Treat as high-risk during review.
26 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: The studio-api file management endpoints historically allowed arbitrary file reads, writes, and deletions due to a lack of centralized path canonicalization and directory boundary checks. Symlinks and null bytes bypassed weak custom validation patterns.
Command Injection: Parsing untrusted input from lock-files or git options directly into shell processes allowed arbitrary command execution. This risk was mitigated by enforcing strict kebab-case regex validation and swapping execSync with execFileSync.
SSRF: Asset download pipelines are exposed to SSRF via remote HTTP redirects that bypass localized private/local IP address checks, allowing access to internal cloud metadata services.