Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
purpleailab/decepticon
main @ ab92536
62
Fixes
0
CVEs
CRITICAL
Peak severity
52.8%
Coverage
Highlights
Denial of Service: 11 prior fixes. Scrutinize any change in this area.
packages/decepticon/decepticon/middleware/roe.py: most-fixed (5 issues). Treat as high-risk during review.
35 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Execution contexts were historically resolved from process-global variables rather than run-specific scopes, allowing concurrent tenants to interact with and compromise shared sandbox resources.
SSRF: Bypasses in scope-enforcement arose from non-canonical address representations (e.g., dotted octals, hex, or short-form IPv4 literals) which evaded standard host blocklists prior to target validation.
Path Traversal: Filesystem backends frequently suffered from directory traversal due to a lack of explicit canonicalization (such as verifying base directories with prefix matches), exposing paths outside designated workspaces.