Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
tractorjuice/arc-kit
main @ 23f3e98
7
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Auth Bypass: 3 prior fixes. Scrutinize any change in this area.
arckit-claude/hooks/allow-plugin-internals.mjs: most-fixed (3 issues). Treat as high-risk during review.
4 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Incomplete path sanitization on Windows allows attackers to bypass security boundaries, like the prefix check in hook restriction logic, using alternate backslash separators. This enables unauthorized script execution.
Path Traversal: Failure to normalize backslashes before performing plugin root containment validation allows attackers to traverse directory boundaries on Windows systems, potentially exposing or executing restricted files.
Auth Bypass: Insufficent validation in the PreToolUse hook allowed automated privilege elevation. Bypasses were mitigated by restricting temporary handoff file paths and hardening environment variable prefixes.