Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
hkuds/vibe-trading
main @ 81c5caf
26
Fixes
0
CVEs
HIGH
Peak severity
39.1%
Coverage
Highlights
Path Traversal: 11 prior fixes. Scrutinize any change in this area.
agent/api_server.py: most-fixed (10 issues). Treat as high-risk during review.
19 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: LLM agent tools and APIs frequently access files on disk, but failing to validate path boundaries allows attackers to escape the workspace directory via canonicalization bypasses. This has required multiple patches to isolate reads and writes to restricted directories.
Auth Bypass: Implicit trust of loopback IP addresses (using _is_local_client checks) exposed privileged LLM configurations and server endpoints to DNS rebinding attacks and cross-site requests, allowing unauthorized remote callers to modify settings.
Cross-Site Request Forgery (CSRF): Unsafe state-changing HTTP methods on the loopback-trusted API lacked proper origin validation, permitting malicious websites to make cross-site requests that execute local actions such as system shutdown or setting updates.