Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

sxyazi/yazi

              main @ ef654f4
            

Fixes

CVEs

MEDIUM

Peak severity

Highlights

Insecure Temporary File: 4 prior fixes. Scrutinize any change in this area.

yazi-config: most-fixed (1 issue). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Insecure Temporary File: Insecure directory creation permissions and race conditions can allow local attackers to intercept or modify runtime files and sockets.

Insecure Temporary File: Insecurely created preview cache directories could allow local users to read or write cached preview data, violating user isolation.

Insecure Temporary File: Concurrent scheduler execution can lead to predictable file path collisions and race conditions if files are not created atomically.