Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

jarrodwatts/claude-hud

              main @ b83b445
            

Fixes

CVEs

HIGH

Peak severity

60.0%

Coverage

Highlights

Command Injection: 3 prior fixes. Scrutinize any change in this area.

commands/setup.md: most-fixed (3 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: The application previously relied on the untrusted COMSPEC environment variable to run system commands, exposing local systems to arbitrary execution. Hardening was achieved by hardcoding absolute binary paths.

Command Injection: Retrieving credentials via shell execution was vulnerable to PATH hijacking and argument injection. Migrating to execFileSync with an absolute system path mitigated this vector.

Remote Code Execution: Execution of arbitrary shell commands via CLI arguments lacked validation, requiring an explicit environment variable opt-in to establish an authorization boundary.