Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
twpayne/chezmoi
master @ 5f78ea6
7
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Information Disclosure: 3 prior fixes. Scrutinize any change in this area.
cmd: most-fixed (1 issue). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: Without enforcing explicit subcommands when interacting with external password managers, specially crafted target identifiers could be interpreted as options or commands, leading to local execution hijacking.
Untrusted Download: Upgrades from remote GitHub releases were processed without rigorous SHA256 checksum validation, exposing users to machine compromise if the remote binary or network path was compromised.
Information Disclosure: Executing secret manager commands during verbose runs risks dumping sensitive raw credentials, master keys, or arguments directly to standard output or log streams.