Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

loft-sh/devpod

              main @ 5a0efcb
            

Fixes

CVEs

HIGH

Peak severity

28.6%

Coverage

Highlights

Denial of Service: 2 prior fixes. Scrutinize any change in this area.

cmd/agent/workspace: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: Unescaped devcontainer post-creation command parameters executed via shell interfaces (su/sh) can lead to command injection under the privileges of the container setup agent.

Information Disclosure: Injecting sensitive configuration details directly into the ContainerEnv environment variables risks credential leakage via diagnostic APIs, subprocess environments, or container metadata.

Insecure Temporary File: Placing forwarded GPG agent sockets in shared locations like /tmp allows local attackers to perform symlink hijacking or capture socket access.