Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
tryethernal/ethernal
develop @ 84f3a93
29
Fixes
0
CVEs
CRITICAL
Peak severity
28.0%
Coverage
Highlights
Auth Bypass: 9 prior fixes. Scrutinize any change in this area.
run/middlewares/auth.js: most-fixed (2 issues). Treat as high-risk during review.
17 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: A critical authentication bypass occurred because a promise-based cryptographic password verification call (firebaseVerify) was not awaited. This meant the check would evaluate as truthy regardless of whether the password was correct.
Command Injection: The project has faced widespread command injection risks across multiple GitHub Action workflows and internal shell scripts. These occurred because untrusted payloads and step outputs (such as git event data and paths) were evaluated inline inside shell commands, rather than being mapped securely to environment variables.
Denial of Service: Database queries and model association getters executed without inheriting the active transaction context. Under load, this caused connection pool leaks and starvation, crashing the service. All database models and queries must explicitly pass active transaction references.