Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
superset-sh/superset
main @ 5eec659
93
Fixes
50
CVEs
CRITICAL
Peak severity
Highlights
Auth Bypass: 36 prior fixes. Scrutinize any change in this area.
apps/desktop/src/main/terminal-host/session.ts: most-fixed (4 issues). Treat as high-risk during review.
53 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: The system command execution engine was vulnerable to arbitrary shell injection via untrusted inputs passed directly into shell contexts. The fix implemented random UUID heredoc delimiters to block execution. Use parameterized processes and restrict raw shell formatting.
Auth Bypass: Database synchronization routes allowed cross-tenant access due to a lack of organization membership verification on incoming queries. The fix enforced checks on 'session.organizationIds' to filter results. Ensure all multi-tenant queries explicitly append the authenticated user's organization scope.
Path Traversal: Path traversal vulnerabilities existed in several filesystem endpoints, allowing reading or writing files outside of the workspace directory. The project applied path canonicalization and strict prefix validations to verify paths remain inside intended boundaries. Always sanitize path resolutions before invoking fs methods.