Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

hkuds/deeptutor

              main @ 30b92df
            

Fixes

CVEs

HIGH

Peak severity

45.0%

Coverage

Highlights

Auth Bypass: 5 prior fixes. Scrutinize any change in this area.

deeptutor/api/routers/guided_learning.py: most-fixed (4 issues). Treat as high-risk during review.

12 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Inconsistent asynchronous context propagation when using FastAPI sync dependencies caused the system to drop multi-user contexts, risking automatic fallback to admin privileges. Consistently using async def auth dependencies is vital.

Sandbox Escape: The tool sandbox allowed unrestricted shell execution. Command executions must be strictly confined to workspace directories, employ safe environment filtering, and prohibit command injection sequences.

Path Traversal: Insufficient validation of identifiers such as book_id permitted directory traversal sequences, allowing attackers to access, write, or delete arbitrary progression JSON files.