Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

openagentplatform/dive

              main @ 4010d87
            

Fixes

CVEs

CRITICAL

Peak severity

80.0%

Coverage

Highlights

Remote Code Execution: 2 prior fixes. Scrutinize any change in this area.

src/App.tsx: most-fixed (3 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: Attackers can abuse the registration of stdio-based MCP servers via crafted deeplinks or malicious configurations to execute arbitrary shell commands. This is a recurring high-impact pattern in the application's configuration loading logic.

Path Traversal: Weak validation of asset protocol paths allowed remote or local attackers to bypass root restrictions and perform arbitrary local file reads using IPC commands.

Cross-Site Scripting (XSS): Unsafe iframe configurations and rendering components without origin-isolated contexts (such as relying on srcDoc instead of Blob URLs) could allow stored scripts to compromise host-level capabilities.