Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

nexu-io/nexu

              main @ dadfb1c
            

Fixes

CVEs

HIGH

Peak severity

36.8%

Coverage

Highlights

Auth Bypass: 7 prior fixes. Scrutinize any change in this area.

apps/api/src/lib/config-generator.ts: most-fixed (2 issues). Treat as high-risk during review.

18 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Critical directory validation bypasses in the desktop controller allowed arbitrary shell execution and path traversal via OS shell-open utilities. Multiple fixes were needed to ensure that target workspace paths are correctly canonicalized and checked against a safe root.

Auth Bypass: Inadequate isolation in multi-tenant shared IM workspaces allowed cross-user data leakage and session hijacking in DM chats, requiring a shift to per-channel-peer session scopes.

Sandbox Escape: Command execution logic bypassed Docker sandboxing, running directly on the gateway host pod, exposing the underlying infrastructure to complete host takeover.