Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
prometheus/client_golang
main @ 28914d0
2
Fixes
1
CVEs
HIGH
Peak severity
Highlights
Credential Leak: 1 prior fix. Scrutinize any change in this area.
.github/workflows: most-fixed (1 issue). Treat as high-risk during review.
0 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Unbounded Cardinality Denial of Service: Attackers can trigger memory exhaustion (DoS) by sending requests with arbitrary HTTP methods, which are tracked as metric labels without validation or filtering. This vulnerability can easily be exploited in environments exposing default instrumented handlers.
Insecure File Permissions: Temporary metrics files created during execution were written with overly permissive default permissions before being renamed. This allowed unauthorized local users to read or modify sensitive metric data prior to permission restriction.
Credential Leak: GitHub Actions workflows that checkout the repository without explicitly disabling credential persistence leave GitHub tokens cached in the local git directory, making them accessible to subsequent potentially untrusted build steps.