Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

rohitg00/agentmemory

              main @ f6f9e3c
            

Fixes

CVEs

HIGH

Peak severity

38.5%

Coverage

Highlights

Auth Bypass: 8 prior fixes. Scrutinize any change in this area.

src/viewer/server.ts: most-fixed (4 issues). Treat as high-risk during review.

16 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Agent isolation bounds configured via AGENTMEMORY_AGENT_SCOPE could be bypassed on BM25-only search paths, allowing unauthorized retrieval of other agents' memories.

Path Traversal: File compression routines lacked symbolic link checks, permitting arbitrary file read/write vectors and symbolic-link-swapping (TOCTOU) exploits during writebacks.

SSRF: Peer registration and synchronization requests were vulnerable to SSRF by automatically following redirects and failing to block requests resolved to private IPv4/IPv6 ranges.