Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
iofficeai/aionui
main @ bc06b27
95
Fixes
0
CVEs
CRITICAL
Peak severity
75.7%
Coverage
Highlights
Denial of Service: 25 prior fixes. Scrutinize any change in this area.
src/process/bridge/fsBridge.ts: most-fixed (7 issues). Treat as high-risk during review.
50 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Authentication Bypass: Asynchronous token verification was not properly awaited in the authentication router, causing the runtime to evaluate the truthy Promise wrapper as a successful validation state. This effectively allowed empty or invalid tokens to bypass authentication.
Path Traversal: Local markdown link handling allowed file path traversal because it resolved and loaded file paths without first canonicalizing relative path segments, exposing files outside of the authorized workspace.
Command Injection: Shell execution bridges utilized shell-interpolated execution (execAsync) with direct string evaluation instead of secure, argument-array-based child_process spawning, exposing the underlying system to arbitrary command injection.