Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

plasmicapp/plasmic

              master @ ca4e963
            

Fixes

CVEs

HIGH

Peak severity

50.0%

Coverage

Highlights

Auth Bypass: 11 prior fixes. Scrutinize any change in this area.

platform/wab/src/wab/server/AppServer.ts: most-fixed (2 issues). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Flaws in core authorization utilities, such as failing to apply user-specific filtering for anonymous users, can lead to widespread unauthorized resource access. This has been a recurring issue across multiple database manager queries and routing components.

Sandbox Escape: The code generation process executes inside a bubblewrap sandbox. Failing to cleanse host environment variables using '--clearenv' allows execution contexts to bleed through, potentially leading to container escapes.

SQL Injection: Exposing dynamic query identifiers and order clauses to raw user filters without rigorous schema validation allows attackers to execute arbitrary database queries against underlying Postgres instances.