Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
openbmb/xagent
main @ 3619c25
2
Fixes
5
CVEs
HIGH
Peak severity
50.0%
Coverage
Highlights
Denial of Service: 1 prior fix. Scrutinize any change in this area.
XAgent/recorder.py: most-fixed (1 issue). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Authentication Bypass: Attackers can manipulate the 'interaction_id' argument in WebSocket endpoints to completely bypass authentication mechanisms, allowing unauthorized session access.
Information Disclosure: Sensitive credentials, specifically 'api_key' structures, were historically exposed via logger sinks. Related vulnerabilities like CVE-2026-4957 show that improper handling of the 'api_key' argument in tool execution leads to sensitive info leakage in logs.
Path Traversal: Lack of strict validation on user-controlled inputs allows remote attackers to traverse directories and read arbitrary system files without requiring administrative privileges.