Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
sylinko/everywhere
main @ b5c8a74
8
Fixes
0
CVEs
HIGH
Peak severity
50.0%
Coverage
Highlights
Auth Bypass: 5 prior fixes. Scrutinize any change in this area.
src/Everywhere.Cloud/OAuthCloudClient.cs: most-fixed (3 issues). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Inadequate authorization checks and flawed permission key resolutions allowed chat plugins to execute privileged capabilities without explicit user consent. Developers must ensure permission evaluations are based on canonical, namespace-qualified identifiers rather than simple names.
Sandbox Escape: Allowing an AI chat assistant to run arbitrary PowerShell scripts without restrictive language constraints enables full code execution outside the intended sandbox. Configuring the session to ConstrainedLanguage mode is required to mitigate this risk.
Auth Bypass: Improper token handling, token confusion (e.g., using access tokens instead of ID tokens), and failure to clear local secrets on silent login failures can lead to localized session hijacking or subscription status bypasses.