Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

superagent-ai/superagent

              main @ 5adc62d
            

Fixes

CVEs

HIGH

Peak severity

Highlights

SSRF: 1 prior fix. Scrutinize any change in this area.

sdk/python/src/safety_agent/utils/input_processor.py: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SSRF: The safety agent input processor suffered from an SSRF vulnerability allowing attackers to bypass network boundaries and make unauthorized internal requests, which was resolved by implementing strict DNS resolution and private IP checks.

SSRF: A parallel SSRF flaw existed in the TypeScript SDK's input processor, highlighting a cross-language implementation gap where URL-handling logic lacked validation for loopback addresses and private IP ranges.

Denial of Service (DoS): The client component is historically susceptible to ZIP bomb attacks (CVE-2017-16129) where uncontrolled processing of compressed responses can consume excessive CPU and memory, exhausting system resources.