Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

santifer/career-ops

              main @ 68c0cdf
            

Fixes

CVEs

HIGH

Peak severity

58.3%

Coverage

Highlights

SSRF: 5 prior fixes. Scrutinize any change in this area.

liveness-browser.mjs: most-fixed (2 issues). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SSRF: The liveness checker uses Playwright to navigate to user-supplied locations, introducing critical SSRF risks. Initial defenses using a private IP blocklist were bypassed because of insufficient hostname normalization and IPv4-mapped IPv6 address handling.

Command Injection: System administrative operations triggered command execution through shell interpolation of variables inside `execSync`. Hardening required switching to structured, array-based executions using `execFileSync`.

Command Injection: The merge-tracking mechanism similarly relied on shell execution with `execSync`, leaving it vulnerable to injection of arbitrary commands unless migrated to safe binary execution.