Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
siteboon/claudecodeui
main @ 6761f31
22
Fixes
0
CVEs
CRITICAL
Peak severity
26.3%
Coverage
Highlights
Path Traversal: 6 prior fixes. Scrutinize any change in this area.
server/index.js: most-fixed (5 issues). Treat as high-risk during review.
15 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: Untrusted WebSocket input and session parameters were directly interpolated into active shell execution commands, permitting arbitrary OS command execution on the host system.
Auth Bypass: Critical backend administration endpoints, Git action routes, and control loops were exposed to the network without any authentication middleware or validation checks.
Argument Injection: User-provided repository URLs and options were passed directly to git and CLI subprocesses without argument boundaries, allowing attackers to pass malicious arguments.