Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

microsoft/ufo

              main @ b28183f
            

Fixes

CVEs

CRITICAL

Peak severity

38.9%

Coverage

Highlights

Auth Bypass: 8 prior fixes. Scrutinize any change in this area.

ufo/server/ws/handler.py: most-fixed (5 issues). Treat as high-risk during review.

19 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: WebSocket message parsing lacked strict validation of client-supplied identity, role, and client-type fields, allowing authenticated clients to spoof identities, escalate privileges, and dispatch tasks to other devices. This is tracked in CVE-2026-46414.

Command Injection: The PowerShell and generic shell client components historically executed system commands using unsafe shell execution (such as subprocess.Popen with shell=True), permitting arbitrary command injection and sandbox escapes via .NET static method invocations. This is tracked in CVE-2026-45322.

Missing Authentication: Crucial web and WebSocket endpoints, such as those dispatching tasks or listing active clients, were exposed without requiring API key verification, allowing unauthenticated remote attackers to control client connections and execute tasks.