Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
runanywhereai/runanywhere-sdks
main @ c272a1f
55
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Use After Free: 12 prior fixes. Scrutinize any change in this area.
examples/web/RunAnywhereAI/src/views/settings.ts: most-fixed (2 issues). Treat as high-risk during review.
32 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Use After Free: Asynchronous native FFI callbacks (using NativeCallable.listener) frequently outlive backing memory allocations across platform boundaries, resulting in severe Use-After-Free conditions during model and pipeline execution. Transitioning to synchronous NativeCallable.isolateLocal is required.
Path Traversal: Insecure handling of download destination paths allowed files to be written outside of the designated download directory. Proper canonicalization using realpath() before verifying the target prefix must be consistently enforced.
Cryptographic Issues: Sensitive tokens and cryptographic secrets were stored in iOS Keychain without preventing cloud backups, leading to credentials leaking into iCloud. SecItemAdd flags must explicitly enforce kSecAttrAccessibleWhenUnlockedThisDeviceOnly and disable synchronizability.