Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
jesseduffield/lazygit
master @ 6be6c34
27
Fixes
0
CVEs
HIGH
Peak severity
48.1%
Coverage
Highlights
Command Injection: 22 prior fixes. Scrutinize any change in this area.
pkg/commands/git.go: most-fixed (6 issues). Treat as high-risk during review.
14 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: Git subcommands frequently invoke external processes. Untrusted repository configurations can register malicious external diff drivers to run arbitrary binaries. Enforcing the '--no-ext-diff' flag is critical to keeping operations local and secure.
Command Injection: The application relies heavily on shell-based execution for file operations, GPG signing, and custom commands. Inadequate escaping of metacharacters like backticks or single quotes on Unix-like systems allows arbitrary command execution.
Argument Injection: Parameters that resemble command-line options (e.g., filenames starting with a hyphen) can inject flags into Git operations unless a double-dash '--' delimiter is explicitly used to separate options from positional arguments.