Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ruvnet/ruview

              main @ 7831f29
            

Fixes

CVEs

CRITICAL

Peak severity

50.0%

Coverage

Highlights

Denial of Service: 24 prior fixes. Scrutinize any change in this area.

firmware/esp32-csi-node: most-fixed (4 issues). Treat as high-risk during review.

26 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Critical WebSocket authentication bypasses occurred due to trivial/empty token validation checks rather than strict matching against configured token stores. Sibling handshake endpoints failed to restrict access properly.

Auth Bypass: Unprovisioned devices left the ESP32 OTA endpoint wide open to unauthenticated remote firmware updates. Incomplete initialization patterns also bypassed pre-shared key (PSK) validation.

Deserialization of Untrusted Data: Loading PyTorch weights using insecure pickle deserialization (torch.load) allows arbitrary remote code execution via malicious models or checkpoints.