Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
moazbuilds/codemachine-cli
main @ 572def6
3
Fixes
0
CVEs
HIGH
Peak severity
50.0%
Coverage
Highlights
Auth Bypass: 1 prior fix. Scrutinize any change in this area.
.github/workflows/build-binaries.yml: most-fixed (1 issue). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: User inputs were previously passed as command-line arguments to the claude and codex binaries, creating opportunities for command injection. Using standard input for data transmission mitigates this, but any future refactoring of execution runners must avoid reverting to argument-based input pass-through.
Auth Bypass: Inadequate target filtering restrictions previously allowed unauthorized execution of restricted agent coordination scripts. Ensuring that script targets are properly validated before invocation is critical to prevent privilege bypass.
Information Disclosure: Writing sensitive auth tokens to the local filesystem without setting restrictive permissions exposes secrets to other local processes or runners on shared infrastructure. Ensuring that generated configuration files use restrictive permissions (e.g., chmod 600) is necessary to mitigate local exposure.