Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

lykosai/stabilitymatrix

              main @ d97f6cc
            

Fixes

CVEs

HIGH

Peak severity

28.6%

Coverage

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

StabilityMatrix.Avalonia/ViewModels/Dialogs/OAuthGoogleLoginViewModel.cs: most-fixed (2 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Insecure handling of path segments during model import and archive extraction allowed directory traversal, risking arbitrary file writes. Developers must systematically sanitize path segments and check prefixes.

Auth Bypass: Flaws in Google OAuth login flow control, including a missing return in an exception handler and lack of proper state validation/PKCE generation, could allow authentication bypasses.

Command Injection: Unquoted root path arguments in Python virtual environment initialization exposed the system to argument/command injection during process start operations.