Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
jupytext/jupytext
main @ 40f3c5f
2
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Credential Leak: 1 prior fix. Scrutinize any change in this area.
.github/workflows: most-fixed (1 issue). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Unauthorized Code Execution: Untrusted workflow runs (e.g., automated snapshot updates or pull request workflows) can be triggered by external actors, executing arbitrary code within the GitHub Actions runner context. Restricting execution to verified repository contributors is critical.
Credential Leak: By default, the actions/checkout action persists GitHub credentials in the local git configuration of the checked-out repository. If downstream steps run untrusted code (such as tests or documentation build scripts), they can exfiltrate this token, compromising the repository.