Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

instagram/libcst

              main @ 2dc435f
            

Fixes

CVEs

HIGH

Peak severity

66.7%

Coverage

Highlights

Command Injection: 1 prior fix. Scrutinize any change in this area.

.github/workflows/pypi_upload.yml: most-fixed (2 issues). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Insecure CI/CD Workflow: The use of self-hosted runners for building multi-architecture wheels exposed the build infrastructure to potential host compromise from untrusted pull requests. Migrating to GitHub-hosted runners with virtualization mitigates persistent host takeover risks.

Command Injection: Directly interpolating runner-controlled outputs, such as the download path of an artifact, into a shell step allowed for arbitrary command injection. Safely mapping these values to environment variables and quoting them is critical to prevent injection.

Credential Management: Relying on long-lived repository secrets for PyPI deployment carries a high risk of credential exposure. Transitioning to dynamic OIDC-based Trusted Publishing removes the need for persistent tokens in the repository configuration.