Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
morloc-project/morloc
master @ ad674b0
7
Fixes
0
CVEs
HIGH
Peak severity
33.3%
Coverage
Highlights
Path Traversal: 2 prior fixes. Scrutinize any change in this area.
(Python: most-fixed (1 issue). Treat as high-risk during review.
6 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Repository and module resolution processes are highly susceptible to path traversal and indirect command execution. Handling raw identifiers ('repo' and 'snapshotIdent') via shell commands (callCommand) without robust escaping allows malicious module definitions to compromise the host system.
Command Injection: The translation and generation of foreign-language calls (C++, R) via shell interpreters pose a significant command injection risk if arguments are not strictly sanitized and escaped before execution.
Sandbox Escape: The expression evaluation sandbox can be subverted if local module resolution is allowed or if recursive expression validation checks are bypassed, letting users execute arbitrary untrusted code.