Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

qingchencloud/clawpanel

              main @ bc5a302
            

Fixes

CVEs

CRITICAL

Peak severity

57.1%

Coverage

Highlights

Command Injection: 3 prior fixes. Scrutinize any change in this area.

scripts/dev-api.js: most-fixed (2 issues). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: User-supplied search queries and commands were directly executed in shell environments via execSync. Developers must consistently migrate to safe process spawning APIs like spawnSync with parameterized arguments to avoid shell metacharacter expansion.

Path Traversal: Insecure file management allowed reading, writing, and listing files outside of the designated hermes_home root directory. Ensuring strict canonicalization and prefix-matching of paths is critical for all filesystem commands.

Command Injection: Executing terminal script commands on Windows via direct command-line parameter interpolation led to command injection. Using temporary, isolated batch runners is necessary to circumvent cmd.exe shell expansion.