Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

nanbingxyz/5ire

              main @ c7fabb9
            

Fixes

CVEs

CRITICAL

Peak severity

37.5%

Coverage

Highlights

Cross-Site Scripting (XSS): 2 prior fixes. Scrutinize any change in this area.

src/hooks/useMarkdown.ts: most-fixed (3 issues). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: Unsafe handling of protocol schemes and window navigation events in the Electron main process allows attackers to bypass protocol validation, triggering remote code execution via shell.openExternal.

Cross-Site Scripting (XSS): The rendering of markdown diagrams and raw HTML using weak configurations or insufficient sanitization rules allows attackers to run arbitrary scripts in the renderer context, which can chain to full system compromise.

Sandbox Escape: External inputs processed through custom deep links or Model Context Protocol (MCP) server keys can bypass path sanitization, resulting in directory traversal or injection of malicious servers.