Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
upstash/context7
master @ a914a86
4
Fixes
0
CVEs
HIGH
Peak severity
0.0%
Coverage
Highlights
Path Traversal: 2 prior fixes. Scrutinize any change in this area.
packages/cli/src/utils/installer.ts: most-fixed (2 issues). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: The installer utility is highly susceptible to path traversal attacks during file writes and symlink creations. Maliciously crafted skill names or file structures can escape the target root directory, potentially leading to arbitrary file write or deletion on the user's system.
Command Injection: Spawning subprocesses with shell:true enables Command Injection via unsanitized environment variables like EDITOR. Standardizing on shell-less execution is critical when delegating actions to external system editors.
Incorrect Permission Assignment: Insecure local file writes of sensitive authentication tokens allow other local users to read credentials if standard restrictive permissions (0o600) are not explicitly enforced.