Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mksglu/context-mode

              main @ 608584b
            

Fixes

CVEs

HIGH

Peak severity

43.8%

Coverage

Highlights

Auth Bypass: 23 prior fixes. Scrutinize any change in this area.

src/server.ts: most-fixed (16 issues). Treat as high-risk during review.

44 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Workspace boundary escapes are a frequent issue when resolving project files. Secure paths must be canonicalized and validated using strict prefix checking to prevent arbitrary filesystem access and sandbox escapes.

Command Injection: Using shell-interpolated execution functions like execSync creates direct pathways to command injection. Replacing shell execution with direct parameterized process spawning (execFileSync, spawnSync) is vital.

Auth Bypass: Tool routing mechanisms frequently suffer from fail-open behaviors when security files fail to load, or bypasses through unhandled tool aliases and prefix variations like '__execute'.