Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

sherlock-project/sherlock

              master @ 206068d
            

Fixes

CVEs

CRITICAL

Peak severity

0.0%

Coverage

Highlights

Auth Bypass: 1 prior fix. Scrutinize any change in this area.

.github/workflows/validate_modified_targets.yml: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Checking out untrusted pull request code (the head SHA) inside privileged workflow contexts allows arbitrary code execution in CI runners. Developers must enforce checking out the repository's base ref instead of the untrusted merge head.

Command Injection: Directly interpolating step outputs or git metadata into a shell 'run' block allows malicious PR authors to execute arbitrary commands. Outputs must be mapped to safe, intermediate environment variables instead of direct script interpolation.

Denial of Service: Making outbound HTTP connections without a hard timeout can cause the client to hang indefinitely, depleting system resources. Every network handshake and read must have strict deadlines.