Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

iotaledger/firefly

              develop @ 89c9e0d
            

Fixes

CVEs

HIGH

Peak severity

56.3%

Coverage

Highlights

Auth Bypass: 5 prior fixes. Scrutinize any change in this area.

packages/desktop/electron/main.js: most-fixed (3 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Bypassing authentication during wallet backup or export operations allows unauthorized exports of the user's Stronghold wallet without key validation. Historically, API methods did not mandate the password parameter or enforce callback validation during export flows.

Cleartext Storage in Memory: Sensitive Stronghold passwords and mnemonics were historically retained in application memory during state transitions such as onboarding or password updates, leaving credentials exposed in process memory.

Sandbox Escape: Insecure Electron main process configurations, missing permission request handlers, and unmitigated IPC or renderer capabilities pose a significant risk of remote code execution or sandbox escape.