Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
mawww/kakoune
master @ 2d94b03
15
Fixes
0
CVEs
HIGH
Peak severity
35.7%
Coverage
Highlights
Command Injection: 5 prior fixes. Scrutinize any change in this area.
src/commands.cc: most-fixed (4 issues). Treat as high-risk during review.
10 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: Exported environment variables can be leveraged to inject arbitrary commands during shell expansion due to unsafe quoting mechanisms. Ensuring shell-specific quoting is consistently applied to exported parameters is vital.
Command Injection: Unsafe argument concatenation inside %arg{@} blocks allows malicious parameter payloads to execute arbitrary shell commands. Proper token-based forwarding of parameters must be enforced.
Use After Free: Asynchronous key and menu callbacks can access destroyed shell context structures, leading to memory corruption. Capturing these context structures by deep-copying them mitigates the lifetime management risk.