Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

memodb-io/acontext

              main @ 259d73b
            

Fixes

CVEs

CRITICAL

Peak severity

47.1%

Coverage

Highlights

Auth Bypass: 4 prior fixes. Scrutinize any change in this area.

src/packages/openclaw/index.ts: most-fixed (2 issues). Treat as high-risk during review.

11 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: The application suffers from recurring path traversal vulnerabilities when processing, syncing, and writing local skill files, which can allow arbitrary file writes. Safeguards must ensure that resolved destinations do not escape the designated directories.

Auth Bypass: Tenant and project isolation failures have allowed cross-project resources to be accessed or modified, such as unauthorized message injection. Explicit validation of resource ownership against the active session's ProjectID is critical.

Command Injection: String interpolation of unsanitized paths into shell execution commands allows execution of arbitrary OS commands in sandbox environments. Structured API calls like sandbox.exists and sandbox.mkdir must replace raw shell execution.