Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
nexu-io/html-anything
main @ 8fd5227
2
Fixes
0
CVEs
HIGH
Peak severity
Highlights
DNS Rebinding: 1 prior fix. Scrutinize any change in this area.
next/src/lib/skills/install.ts: most-fixed (1 issue). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: The community skill installation pipeline accepted tar headers without adequate path sanitization, potentially allowing arbitrary file writes and system-wide modifications during extraction via symlinks or relative paths.
DNS Rebinding: Lack of strict Host header validation in the API middleware made the local agent CLI endpoints vulnerable to DNS rebinding, which could allow malicious external sites to execute unauthenticated local code.