Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

tw93/mole

              main @ 6be20ea
            

Fixes

CVEs

HIGH

Peak severity

50.0%

Coverage

Highlights

Path Traversal: 15 prior fixes. Scrutinize any change in this area.

lib/core/app_protection.sh: most-fixed (5 issues). Treat as high-risk during review.

9 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Recursive deletion routines failed to resolve symlinks and canonicalize paths properly, allowing directory traversals to escape safe boundaries during privileged execution. Hardening requires strict prefix validation and target resolution.

Path Traversal: Input paths supplied to macOS deletion processes were canonicalized late or improperly analyzed, permitting '..' segments or relative traversal targets to be moved to the trash or removed entirely.

Command Injection: Unsanitized bundle identifiers passed directly into shell-based 'defaults' utilities or command strings allow remote or local attackers to execute arbitrary system-level commands.