Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
rowboatlabs/rowboat
main @ e2178c1
10
Fixes
2
CVEs
CRITICAL
Peak severity
25.0%
Coverage
Highlights
Auth Bypass: 3 prior fixes. Scrutinize any change in this area.
apps/cli/src/application/lib/agent.ts: most-fixed (1 issue). Treat as high-risk during review.
7 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: The platform executes system commands based on agent input. Weak command validation regexes previously allowed subshell syntax and backtick injection to escape restrictions and execute arbitrary shell code.
Remote Code Execution: Agent execution loops allow command execution skills. Without a strict binary allowlist, an agent or untrusted input could invoke arbitrary system binaries.
Auth Bypass: Webhooks lacked robust signature verification, allowing remote attackers to spoof actions by bypassing integrity verification checks.