Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

opencoworkai/open-cowork

              main @ 8e60460
            

Fixes

CVEs

CRITICAL

Peak severity

52.6%

Coverage

Highlights

Path Traversal: 12 prior fixes. Scrutinize any change in this area.

src/main/claude/agent-runner.ts: most-fixed (4 issues). Treat as high-risk during review.

29 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: The application utilized vulnerable shell execution pattern 'execAsync' to run commands, which was resolved by replacing it with argument-safe 'execFileAsync' alongside input validation.

Path Traversal: Sandbox escapes were possible because symlinks targets were not validated against the sandbox root path, requiring realpath resolution to enforce strict containment boundaries.

Auth Bypass: Local-agent tool execution (like bash, write, and edit) lacked permission-gating hooks, enabling unauthorized tool calls to execute arbitrary system commands.