Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

kubeshop/testkube

              main @ dc15f57
            

Fixes

CVEs

HIGH

Peak severity

37.5%

Coverage

Highlights

Denial of Service: 28 prior fixes. Scrutinize any change in this area.

pkg/executor: most-fixed (3 issues). Treat as high-risk during review.

17 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Inadequate verification of namespace boundaries during secret resolution allowed cross-namespace secret retrieval via git credential injection. Developers must validate that requested credentials belong to the authorized namespace before retrieval.

Command Injection: Unescaped user input passed directly to Kubernetes job spec templates allowed command injection. Every workflow, CRD generator, and template rendering engine must carefully escape and quote commands, arguments, and parameters before generating YAML.

Path Traversal: Arbitrary file read vulnerabilities existed due to unsandboxed filesystem helpers within template expressions. Filesystem operations must be pinned to virtual file systems or explicitly scoped with canonical path resolution and prefix validation.