Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
jart/cosmopolitan
master @ 0368456
16
Fixes
0
CVEs
HIGH
Peak severity
44.4%
Coverage
Highlights
Information Disclosure: 2 prior fixes. Scrutinize any change in this area.
ctl/string.cc: most-fixed (1 issue). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Sandbox Escape: Incomplete restriction policies or missing system call filters in the polyfill allow processes to bypass intended sandboxing boundaries. Developers must carefully audit seccomp-bpf filter lists when introducing new system call wrappers.
Path Traversal: Improper path canonicalization on Windows and Unix-like environments can allow attackers to traverse out of the restricted directories. Any file access paths must be strictly normalized and verified.
Memory Corruption: Bugs in small-string optimization, reserve allocation, or manual buffer manipulations can lead to out-of-bounds writes or undefined behaviors. Using bounded operations is critical.