Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
pypa/build
main @ a8b164d
2
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Command Injection: 1 prior fix. Scrutinize any change in this area.
Actions: most-fixed (1 issue). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: Untrusted parameter expansion inside inline bash scripts in GitHub Actions workflows can lead to arbitrary code execution within the runner context. This bypasses structural validation and allows malicious actors to hijack CI/CD environments.
Path Traversal: Extracting source distribution tarballs without rigorous path validation exposes the system to path traversal attacks. Malicious packages can overwrite files outside the target directory using directory escapes, symlinks, or hardlinks during extraction via tarfile APIs.