Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

stablyai/orca

              main @ 04ec8e6
            

Fixes

CVEs

CRITICAL

Peak severity

14.8%

Coverage

Highlights

Denial of Service: 38 prior fixes. Scrutinize any change in this area.

src/main/ipc/filesystem-auth.ts: most-fixed (10 issues). Treat as high-risk during review.

27 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Filesystem authorization checks frequently failed to prevent directory traversal because of incomplete path canonicalization (e.g., missing realpath calls, failure to handle macOS /tmp path redirects, missing Windows drive letter comparisons, and improper relative path prefix matching).

Command Injection: The application permitted the execution of repository-defined hooks during worktree lifecycle events without explicit user trust boundaries, allowing arbitrary command execution if an attacker can control the repository layout or configuration files.

Auth Bypass: Insecure handling of terminal paste operations and raw terminal keystroke injection over IPC boundaries allowed untrusted payloads to execute commands within local sessions.